Langsmith Tracing
Automatically send Claude Code conversation traces to LangSmith for monitoring and analysis. Prerequisites: jq (brew install jq on macOS or sudo apt-get install jq on Linux), curl and uuidgen (usually pre-installed), LangSmith account and API key. Configuration: Install langsmith-tracing setting (npx claude-code-templates@latest --setting telemetry/langsmith-tracing) or manually add to .claude/settings.local.json the following environment variables: TRACE_TO_LANGSMITH=true, CC_LANGSMITH_API_KEY=lsv2_pt_..., CC_LANGSMITH_PROJECT=project-name, CC_LANGSMITH_DEBUG=true (optional). How it works: Runs in background on Stop event after each Claude response, reads conversation transcript, converts to LangSmith format, sends to LangSmith API, groups by thread_id for session continuity. Debugging: Check logs at ~/.claude/state/hook.log. Privacy note: System prompts not included in traces.
npx claude-code-templates@latest --hook monitoring/langsmith-tracing Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-23
Partial analysis: some checks could not run on this component.
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Autonomous Decision MakingExcessive Agency · SKILL.md:3
- Autonomous Decision MakingExcessive Agency · langsmith-tracing.json:2
- Without declared permissions the skill's intent is opaque and cannot be validated.MCP Least Privilege · SKILL.md:1
- MCP server references in the skill manifest without version pinning are a rug-pull risk.MCP Rug Pull · SKILL.md:1
- Sudo/Root ExecutionPrivilege Escalation · SKILL.md:3
Showing 5 of 9 observations. Learn more about NVIDIA SkillSpector.