The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION] (LOW): The skill functions by retrieving and displaying raw LLM traces, which inherently contain untrusted data.
Ingestion points: scripts/fetch-trace.ts, scripts/fetch-traces.ts, and scripts/list-prompts.ts all output raw string data from the Langfuse API.
Boundary markers: Absent. The JSON output does not wrap LLM-generated content in delimiters or provide 'ignore embedded instructions' warnings.
Capability inventory: While the skill scripts are read-only, the agent environment likely includes file-system or command-execution capabilities that could be targeted by instructions found inside a trace.
Sanitization: None. The scripts perform direct JSON serialization of API responses without filtering or escaping content.
[CREDENTIALS_UNSAFE] (SAFE): The skill correctly requires LANGFUSE_SECRET_KEY and LANGFUSE_PUBLIC_KEY to be provided via environment variables. No hardcoded secrets were found in the scripts or documentation.
[EXTERNAL_DOWNLOADS] (SAFE): Dependencies are limited to the official langfuse SDK and standard TypeScript development tools (tsx, typescript). These are well-known packages from a standard registry.
[COMMAND_EXECUTION] (SAFE): The scripts use process.argv for parameters like trace-id or limit. These values are passed as typed arguments to the Langfuse SDK and are not executed as shell commands.

langfuse-observability