langfuse-observability

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements standard observability patterns for tracking LLM application health. It correctly references well-known services and the author's verified infrastructure without any signs of malicious intent or unauthorized data access.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a vulnerability surface by ingesting untrusted LLM data for monitoring purposes.
  • Ingestion points: LLM request messages and response content are captured through instrumentation wrappers in SKILL.md and references/implementation.md.
  • Boundary markers: The provided implementation code does not include explicit boundary markers or instructions to ignore embedded content within the telemetry stream.
  • Capability inventory: The skill environment uses openai, @langfuse/client, and @langfuse/tracing libraries and is granted Read, Write, and Edit tool permissions.
  • Sanitization: Captured LLM data is processed and transmitted to the observability platform without transformation or sanitization to ensure metric accuracy.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:46 AM