context-sweet-spot
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
langwatchCLI tool from the npm registry usingnpm install -g langwatch. It also utilizesnpxfor executing diagnostic reports. - [COMMAND_EXECUTION]: The skill executes multiple shell commands via the
langwatchCLI to export traces, fetch session events, and retrieve documentation from the vendor's platform. - [DATA_EXFILTRATION]: The skill contains instructions for a diagnostic reporting feature (
langwatch report) that sends data to the vendor's infrastructure for troubleshooting. This behavior is mitigated by explicit requirements for user approval, a mandatory--user-approvedflag, local data scrubbing of PII/secrets, and the recommendation to use--dry-runfor inspection before sending. - [INDIRECT_PROMPT_INJECTION]: The skill processes external session logs and traces which could contain untrusted data from previous agent interactions. It performs statistical analysis on this data (calculating token counts, costs, and cache rebuilds) rather than direct execution, which limits the risk of instruction injection.
Audit Metadata