langfuse-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill executes a shell command at load time to check for the presence of required NPM packages in the local environment.
- Evidence: SKILL.md contains the dynamic context block
!npm list langfuse @langfuse/client 2>/dev/null | head -5 || echo 'No langfuse packages'` which executes when the skill is accessed. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external observability platforms (Langfuse and LangSmith) that could potentially contain embedded instructions or malicious content.
- Ingestion points: Scripts in SKILL.md and references/implementation.md fetch traces, prompts, and datasets using calls like
source.api.traces.list(),source.api.prompts.list(), andsource.api.datasets.list(). - Boundary markers: None present; the fetched content is processed as raw data and written to JSON files without delimiters or instructions to ignore embedded content.
- Capability inventory: The skill possesses
Write,Edit, andBash(npm:*)capabilities which could be leveraged if malicious data were to influence agent behavior. - Sanitization: The implementation scripts do not perform validation or sanitization of the data retrieved from external APIs before writing it to the local filesystem or using it in subsequent migration steps.
Audit Metadata