langsmith-observability
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from LLM inputs and production traces which may contain malicious instructions. Ingestion points occur through tracing decorators (@traceable) and dataset management (create_dataset, create_examples). No explicit boundary markers are enforced in the examples to delimit external data. Capabilities include LangSmith API communication and execution of Python-based evaluators. The skill includes documentation for input and output sanitization to mask sensitive fields using the process_inputs and process_outputs parameters.
- [EXTERNAL_DOWNLOADS]: The skill documents installing the 'langsmith' package from PyPI, which is a well-known observability service.
- [COMMAND_EXECUTION]: The skill provides standard shell commands for environment variable setup (export) and package installation (pip install).
Audit Metadata