langchain-components
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a static documentation repository and technical reference for the LangChain, LangGraph, and Deep Agents frameworks. No malicious code or hidden instructions were detected across the reference files.
- [EXTERNAL_DOWNLOADS]: The documentation references installation commands for numerous standard and well-known packages, including
langchain,langgraph,langsmith, and integrations for major providers like OpenAI, Anthropic, Google, and AWS. These are all well-known services and repositories. - [COMMAND_EXECUTION]: The skill is configured with
Bashaccess in itsallowed-tools. The reference material documents tools with shell execution capabilities (e.g., theexecutetool in the Deep Agents framework). These are presented as standard features of the developer tools being documented and are consistent with the skill's purpose as a technical reference. - [DYNAMIC_EXECUTION]: Reference examples include patterns for tools that use
eval()(e.g., a calculator tool example). This is documented as a functional example for specific tool implementations rather than a runtime behavior of the skill itself. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests large amounts of text documentation. However, the risk is mitigated as the documentation is static, bundled with the skill, and oriented toward developer guidance.
Audit Metadata