langsmith-evaluator
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [Remote Code Execution from Vendor Source]: The skill instructs the user to install the LangSmith CLI by downloading and executing a shell script from
https://cli.langsmith.com/install.sh. While executing remote scripts via shell piping is a security consideration, this particular source is the official domain for the vendor's product. This is a common installation pattern for developer tools. - [Credential Management Guidance]: The skill discusses the use of environment variables like
LANGSMITH_API_KEYandOPENAI_API_KEYfor authentication. It correctly advises against hardcoding these keys in commands or logs and recommends using the CLI's profile management system, which is a positive security practice. - [Telemetry and Feedback]: The skill includes a feedback mechanism (
langsmith feedback) that sends data to LangSmith Cloud. It provides explicit warnings to users not to include sensitive data, secrets, or customer information in these feedback notes, emphasizing data privacy.
Audit Metadata