langsmith-trace
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Remote Script Installation: The skill provides a command to install the
langsmithCLI using a shell script fetched directly from the official LangChain AI GitHub repository (https://raw.githubusercontent.com/langchain-ai/langsmith-cli/main/scripts/install.sh). This is a common installation pattern for developer tools from established vendors. - Trace Data Management: The skill includes commands for exporting trace data (
langsmith trace export). Users should be aware that exported trace files (.jsonl) may contain sensitive information, such as application inputs, outputs, and metadata, depending on what was logged during the application's execution. - Environment Variable Usage: Instructions recommend setting
LANGSMITH_API_KEYand checking.envfiles. This follows standard security practices for managing secrets outside of source code, though users should ensure these files are properly secured and excluded from version control. - Data Ingestion Surface: By querying and exporting traces, the agent may process data originating from external application logs. As with any skill that reads external content, there is a potential surface for indirect prompt injection if the agent attempts to interpret instructions found within the trace data itself.
Audit Metadata