langsmith-trace

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • Remote Script Installation: The skill provides a command to install the langsmith CLI using a shell script fetched directly from the official LangChain AI GitHub repository (https://raw.githubusercontent.com/langchain-ai/langsmith-cli/main/scripts/install.sh). This is a common installation pattern for developer tools from established vendors.
  • Trace Data Management: The skill includes commands for exporting trace data (langsmith trace export). Users should be aware that exported trace files (.jsonl) may contain sensitive information, such as application inputs, outputs, and metadata, depending on what was logged during the application's execution.
  • Environment Variable Usage: Instructions recommend setting LANGSMITH_API_KEY and checking .env files. This follows standard security practices for managing secrets outside of source code, though users should ensure these files are properly secured and excluded from version control.
  • Data Ingestion Surface: By querying and exporting traces, the agent may process data originating from external application logs. As with any skill that reads external content, there is a potential surface for indirect prompt injection if the agent attempts to interpret instructions found within the trace data itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 07:09 AM