langgraph
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes scaffolding scripts (
lg-supervisor-scaffold.py,lg-swarm-scaffold.py) that generate Python project files (state, agents, graph, and main entry points) using string templates. This functionality is the intended purpose of the tool and helps jumpstart development of LangGraph workflows. - [DYNAMIC_EXECUTION]: The script
lg-eval-generator.pygenerates Python code for evaluation pipelines, embedding user-provided data into a script that can be executed to run LangSmith evaluators. - [INDIRECT_PROMPT_INJECTION]: The
lg-eval-generator.pyscript possesses an ingestion surface as it reads user-provided JSON or YAML specification files to build evaluation datasets, representing a potential entry point for untrusted content in an evaluation context. - [DYNAMIC_EXECUTION]: The
compile()calls identified by static analysis inassets/templates/subgraph-agent.pyare part of thelanggraph.graph.StateGraph.compile()method, which is a standard library function used to transform a defined graph into a runnable object, rather than the Pythoncompile()builtin used for arbitrary code execution.
Audit Metadata