langsmith-trace
The skill executes unverified remote code via shell pipes and performs unauthorized network operations without declaring necessary tool permissions, creating a critical risk of arbitrary code execution.
Skill Info
Install
npx skills add https://github.com/langchain-ai/langsmith-skillsAssessments (3)
AI Agent Traps ↗Remote code download and execution detected
curl -sSL https://raw.githubusercontent.com/langchain-ai/langsmith-cli/main/scripts/install.sh | sh
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.
curl -sSL https://raw.githubusercontent.com/langchain-ai/langsmith-cli/main/scripts/install.sh | sh
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/langchain-ai/langsmith-skills/langsmith-trace)<a href="https://mondoo.com/ai-agent-security/skills/github/langchain-ai/langsmith-skills/langsmith-trace"><img src="https://mondoo.com/ai-agent-security/api/badge/github/langchain-ai/langsmith-skills/langsmith-trace.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/langchain-ai/langsmith-skills/langsmith-trace.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow