langsmith-dataset
The skill executes unverified remote code via shell pipes, bypasses critical user confirmation prompts, and lacks necessary tool constraints, creating a high risk of arbitrary command execution and system compromise.
Skill Info
Install
npx skills add https://github.com/langchain-ai/langsmith-skillsAssessments (6)
AI Agent Traps ↗Remote code download and execution detected
curl -sSL https://raw.githubusercontent.com/langchain-ai/langsmith-cli/main/scripts/install.sh | sh
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.
curl -sSL https://raw.githubusercontent.com/langchain-ai/langsmith-cli/main/scripts/install.sh | sh
The instructions explicitly provide guidance on how to bypass confirmation prompts using the '--yes' flag for non-interactive runs, which increases the risk of accidental data loss.
If you are running non-interactively: Use --yes to skip confirmation prompts
Unpinned dependency installation — package installed without version pinning (seen 2 times in this file at lines 28, 33)
pip install langsmith
User confirmation bypass detected — attempts to skip human oversight (seen 2 times in this file at lines 69, 74)
Skip confirmation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/langchain-ai/langsmith-skills/langsmith-dataset)<a href="https://mondoo.com/ai-agent-security/skills/github/langchain-ai/langsmith-skills/langsmith-dataset"><img src="https://mondoo.com/ai-agent-security/api/badge/github/langchain-ai/langsmith-skills/langsmith-dataset.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/langchain-ai/langsmith-skills/langsmith-dataset.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow