langsmith-custom-apps

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Data Handling and Sanitization: The skill incorporates security best practices, such as advising the use of environment variables for API keys rather than hardcoding them. It also provides a comprehensive checklist for sanitizing application source code before sharing it externally, including the removal of internal identifiers, registry tokens, and sensitive keys.
  • External API Interaction: The instructions include a fallback mechanism to retrieve application source code from the LangSmith API using curl and a transparent, inline Python script. This operation interacts with the vendor's official infrastructure to perform the skill's core functionality.
  • Command Execution for Development: The skill utilizes standard development tools and CLI commands (such as npm, npx, and langsmith) for scaffolding, building, and deploying applications. These operations are routine for a React and TypeScript development environment.
  • Input Validation Considerations: The skill identifies potential risks associated with processing trace data from external sources and provides specific mitigations. For example, it recommends avoiding dangerouslySetInnerHTML for trace content and suggests validating IDs before they are interpolated into query filters to maintain execution integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 07:09 PM