langfuse-setup
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to verify environment variables, check for the presence of local files, and execute a Python-based connection test via
uv run. These operations are transparent, task-specific, and necessary for the stated purpose of configuring the Langfuse integration. - [EXTERNAL_DOWNLOADS]: The skill uses
uv run --with langfuse, which ensures thelangfusepackage is available. Langfuse is a well-known and established observability platform. This usage is consistent with standard development practices for managing dependencies. - [DATA_EXFILTRATION]: While the skill manages sensitive API keys (
LANGFUSE_PUBLIC_KEY,LANGFUSE_SECRET_KEY), it includes explicit instructions to verify their existence without echoing or logging their values. The connection test targets the official Langfuse host (or a user-defined host), which is the intended destination for this observability data. - [SAFE]: The modification of
~/.claude/settings.jsonis limited to adding or removing specific hook configurations. The instructions emphasize preserving existing user settings and provide clear before/after visibility, minimizing the risk of accidental configuration loss or unauthorized changes.
Audit Metadata