langfuse

Warn

Audited by Socket on Apr 29, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The skill's purpose is plausible, but its actual setup routes Langfuse credentials and observability data through a third-party unpinned Python package from a personal repo instead of Langfuse's official MCP offering. That mismatch makes the credential and supply-chain footprint disproportionate to the stated purpose.

Confidence: 92%Severity: 88%
Audit Metadata
Analyzed At
Apr 29, 2026, 08:10 PM
Package URL
pkg:socket/skills-sh/avivsinai%2Flangfuse-mcp%2Flangfuse%2F@c2aa2586b9161bb7db125238425d7c7861ff8636