langfuse-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited langfuse-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill orchestrates getting onto Langfuse well: choosing a deployment, sequencing onboarding so the irreversible decisions are made first, verifying the first trace, and confirming production-readiness. It is the planning layer around the official langfuse skill, which owns the instrumentation code itself.
anything that goes stale — exact SDK code, config flags, version numbers — fetch the live docs by appending .md to any page URL (e.g. https://langfuse.com/docs/observability/get-started.md) or use https://langfuse.com/api/search-docs?query=.... Never instrument from memory.
upgrades, use the vendored langfuse skill (skills/langfuse/). Do not duplicate or rewrite that guidance here — hand off to it at the right step.
environment partitioning are painful to change after data exists. Settle them before ingesting real traffic.
Determine which case applies:
langfuseskill for instrumentation, then verify + readiness.
references/production-readiness.md.references/onboarding-sequence.md(step 6); if unresolved, search-docs for the specific symptom.
Use references/cloud-vs-self-host.md. Default to Langfuse Cloud unless a hard requirement (data residency, VPC/air-gap, compliance, very-high-scale cost, EE-on-own-infra) forces self-hosting. Region is permanent per project — decide before creating anything.
Follow references/onboarding-sequence.md in order: account → project → API keys (into env, never chat) → instrumentation (hand off to the langfuse skill) → first trace → verify → organize (environments, releases, user/session tagging).
For credentials, give the user assets/.env.example to fill in (it lists every region URL and the required variables) and have them set keys in their shell or .env — never paste secret keys into chat. For the exact env-var semantics (LANGFUSE_HOST vs LANGFUSE_BASE_URL, etc.), defer to the vendored langfuse skill, which documents them.
Confirm the trace appears in the UI and the SDK auth check passes; ensure short-lived processes flush before exit. Details in references/onboarding-sequence.md (step 6).
Before real traffic, walk references/production-readiness.md — data retention, PII masking, RBAC, environment separation, sampling, cost tracking, spend alerts, flush-on-shutdown, and (self-host) UTC, backups, encryption, health checks, upgrade path.
table, self-host deployment tiers and the architecture/UTC requirement you commit to operating.
/ troubleshooting; explains why the order matters.
quality, reliability, self-host specifics), each item linking the live doc for exact config.
| Need | Where |
|---|---|
| Instrumentation code, CLI, prompt migration, SDK upgrade | vendored langfuse skill (skills/langfuse/) |
| Exact config for any setting | live docs via .md-append or search-docs |
| Deployment decision, onboarding order, prod checklist | this skill |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.