langsmith-custom-apps
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Data Handling and Sanitization: The skill incorporates security best practices, such as advising the use of environment variables for API keys rather than hardcoding them. It also provides a comprehensive checklist for sanitizing application source code before sharing it externally, including the removal of internal identifiers, registry tokens, and sensitive keys.
- External API Interaction: The instructions include a fallback mechanism to retrieve application source code from the LangSmith API using
curland a transparent, inline Python script. This operation interacts with the vendor's official infrastructure to perform the skill's core functionality. - Command Execution for Development: The skill utilizes standard development tools and CLI commands (such as
npm,npx, andlangsmith) for scaffolding, building, and deploying applications. These operations are routine for a React and TypeScript development environment. - Input Validation Considerations: The skill identifies potential risks associated with processing trace data from external sources and provides specific mitigations. For example, it recommends avoiding
dangerouslySetInnerHTMLfor trace content and suggests validating IDs before they are interpolated into query filters to maintain execution integrity.
Audit Metadata