langchain-python-quickstart
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- External Resource Access: The skill is designed to fetch setup instructions from official documentation. While this is a standard practice for ensuring accurate configuration, it involves processing information from a remote source at runtime.
- Software Installation and Execution: To achieve its goal, the skill instructs the agent to install necessary Python libraries and execute the generated script locally. This is a functional requirement for scaffolding a development project but involves the use of execution capabilities.
- Secret Management Best Practices: The skill encourages the use of
.envfiles for API keys and advises against pasting credentials directly into the chat, which aligns with secure development practices. - Data Processing Considerations: By fetching and interpreting external content to generate and run code, the skill introduces a potential surface for indirect prompt injection.
- Ingestion points: Documentation content is retrieved from
docs.langchain.com(referenced inSKILL.md). - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the fetched documentation.
- Capability inventory: The skill utilizes file writing, package installation, and Python script execution.
- Sanitization: The skill does not explicitly define sanitization or validation steps for the content fetched from the remote documentation.
Audit Metadata