langgraph

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill includes scaffolding scripts (lg-supervisor-scaffold.py, lg-swarm-scaffold.py) that generate Python project files (state, agents, graph, and main entry points) using string templates. This functionality is the intended purpose of the tool and helps jumpstart development of LangGraph workflows.
  • [DYNAMIC_EXECUTION]: The script lg-eval-generator.py generates Python code for evaluation pipelines, embedding user-provided data into a script that can be executed to run LangSmith evaluators.
  • [INDIRECT_PROMPT_INJECTION]: The lg-eval-generator.py script possesses an ingestion surface as it reads user-provided JSON or YAML specification files to build evaluation datasets, representing a potential entry point for untrusted content in an evaluation context.
  • [DYNAMIC_EXECUTION]: The compile() calls identified by static analysis in assets/templates/subgraph-agent.py are part of the langgraph.graph.StateGraph.compile() method, which is a standard library function used to transform a defined graph into a runnable object, rather than the Python compile() builtin used for arbitrary code execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 05:57 PM
Security Audit — agent-trust-hub — langgraph