Langfuse Trace Logger

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent Langfuse logging purpose, but it can capture prompts, outputs, and memory-derived history, including sensitive data, without clear redaction or cloud-safety controls.

Install only if you are comfortable with agent prompts, outputs, session metadata, and possibly historical memory-derived task records being stored in your Langfuse project. Prefer a local self-hosted Langfuse instance, redact secrets and personal data before logging, avoid cloud endpoints unless approved, and invoke any logger with safe argument handling rather than interpolating raw prompt text into shell commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58

Finding

Unredacted prompts, outputs, and memory records may be transmitted to Langfuse

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18, 51-64, 78-79, 118, 191
Vulnerability Type: Sensitive data exposure through telemetry
Risk Level: High

Vulnerable Code

yaml

"security_notes": "Writes traces to the user's own Langfuse instance (self-hosted Docker container at localhost:3100 by default). When using self-hosted Langfuse, all trace data stays on the user's machine. Cloud Langfuse users send data only to their own Langfuse account."

bash

~/.chatterbox-venv/bin/python3 /Users/loki/.openclaw/workspace/scripts/langfuse-trace-logger.py \
  --session-id "$SESSION_ID" \
  --parent-id "agent:main" \
  --agent "kit" \
  --task "task-label-kebab-case" \
  --model "anthropic/claude-sonnet-4-6" \
  --status "completed" \
  --input "full task prompt given to agent (first 4000 chars)..." \
  --output "what the agent returned or accomplished..." \
  --duration 278 \
  --tokens 16900 \
  --project "reddi-agent-protocol" \
  --skills "product-tour-capture"

text

| `--input` | string | Full task prompt | First 4000 chars — this is what gets replayed against other models in judge runs |
| `--output` | string | Result summary | Agent's output/result — this is what the judge scores |

text

**Data source:** Backfill parses `memory/YYYY-MM-DD.md` files and extracts structured task outcome blocks. This is why the task outcome block format in memory files must be consistent — inconsistent format breaks parsing silently.

text

**Call once per significant subagent completion.** Use data from the task outcome blocks written in Phase 1 (memory file). Don't reconstruct from memory — read what you just wrote.

Technical Analysis

The skill instructs the agent to record the first 4,000 characters of full task prompts, agent results, session identifiers, project information, and historical task records extracted from persistent memory files. These source ...[truncated 1695 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to metadata-only telemetry and omit raw prompts, outputs, and memory content.
2. Require explicit user opt-in before sending content to any non-local Langfuse endpoint.
3. Apply secret scanning and structured redaction before records are passed to the logger.
4. Use an allowlist of fields approved for telemetry rather than attempting only pattern-based filtering.
5. Exclude persistent memory files from backfill by default, or extract only explicitly marked, non-sensitive fields.
6. Enforce endpoint validation so local-only deployments cannot silently be redirected to a remote host.
7. Document retention, access-control, encryption, export, and deletion requirements for trace data.
8. Add automated tests containing representative API keys, passwords, personal data, and proprietary content to verify that these values never reach trace storage.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:51

Finding

Unsafe shell construction with attacker-controlled prompt and output content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-64
Vulnerability Type: Command injection
Risk Level: High

Vulnerable Code

bash

~/.chatterbox-venv/bin/python3 /Users/loki/.openclaw/workspace/scripts/langfuse-trace-logger.py \
  --session-id "$SESSION_ID" \
  --parent-id "agent:main" \
  --agent "kit" \
  --task "task-label-kebab-case" \
  --model "anthropic/claude-sonnet-4-6" \
  --status "completed" \
  --input "full task prompt given to agent (first 4000 chars)..." \
  --output "what the agent returned or accomplished..." \
  --duration 278 \
  --tokens 16900 \
  --project "reddi-agent-protocol" \
  --skills "product-tour-capture"

Technical Analysis

The documented invocation places full task prompts and agent-produced output directly into command-line arguments. Both values can contain attacker-controlled characters, including quotation marks, command substitutions, newlines, redirection operators, and shell separators.

If an agent implements this example by textually substituting the raw prompt or output into a shell command, embedded content can terminate the quoted argument and introduce additional shell syntax. Correct quoting of a pre-existing shell variable or use of a direct argument-array execution API would avoid shell reinterpretation, but the skill does not mandate either control.

This finding concerns unsafe command construction encouraged by the documentation. The actual logger implementation is absent and therefore could not be checked for additional protections.

Attack Path

1. An attacker places shell syntax in a task prompt or content that will be reproduced in an agent result.
2. During session wrap, the agent constructs the documented command by inserting that raw content into the --input or --output quoted text.
3. The malicious content closes the intended quotation context and adds a command, command substitution, redirection, or shell sepa ...[truncated 802 chars]

Remediation

View remediation

Remediation Suggestions

1. Invoke the logger through an argument-array API with shell processing disabled.
2. Do not concatenate prompts, outputs, session identifiers, or task labels into executable command strings.
3. Pass large or untrusted content through standard input or a securely created JSON file rather than shell command-line arguments.
4. If a shell wrapper is unavoidable, supply content through exported variables and quote each expansion correctly; do not generate shell source containing raw values.
5. Validate constrained fields such as status, agent name, project slug, and task label against strict allowlists.
6. Add tests using quotation marks, newlines, semicolons, command substitutions, and redirection characters to confirm that input remains a single inert argument.
7. Update the skill documentation to provide a safe programmatic invocation instead of an interpolation-oriented shell example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly logs the full task prompt and agent output to Langfuse, and the metadata allows sending those traces either to a self-hosted instance or a cloud-hosted Langfuse account. Because prompts and outputs can contain sensitive user data, project details, credentials, or proprietary content, the lack of a clear warning and redaction guidance creates a real data-exposure risk, especially when the cloud option is used.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

For retroactive logging when a session wrap was skipped or traces are missing.

Idempotent: Uses deterministic trace IDs based on date+agent+task hash. Safe to re-run — won't create duplicates.

bash

# Preview first (dry run)

Static analysis

No suspicious patterns detected.