langfuse-setup

Pass

Audited by Gen Agent Trust Hub on May 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to verify environment variables, check for the presence of local files, and execute a Python-based connection test via uv run. These operations are transparent, task-specific, and necessary for the stated purpose of configuring the Langfuse integration.
  • [EXTERNAL_DOWNLOADS]: The skill uses uv run --with langfuse, which ensures the langfuse package is available. Langfuse is a well-known and established observability platform. This usage is consistent with standard development practices for managing dependencies.
  • [DATA_EXFILTRATION]: While the skill manages sensitive API keys (LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY), it includes explicit instructions to verify their existence without echoing or logging their values. The connection test targets the official Langfuse host (or a user-defined host), which is the intended destination for this observability data.
  • [SAFE]: The modification of ~/.claude/settings.json is limited to adding or removing specific hook configurations. The instructions emphasize preserving existing user settings and provide clear before/after visibility, minimizing the risk of accidental configuration loss or unauthorized changes.
Audit Metadata
Risk Level
SAFE
Analyzed
May 5, 2026, 09:05 AM