Provides automatic tracing, logging, cost tracking, and health monitoring for OpenClaw LLM calls, APIs, tool executions, and custom events.

What to consider before installing: - Missing dependency: The scripts require the Langfuse Python SDK (from langfuse import Langfuse) but the skill provides no install instructions. Ensure you install and vet the SDK version (v3.14.x) before enabling the skill. - Hard-coded credentials and defaults: The code contains default PUBLIC and SECRET keys and a default host (http://langfuse-web:3000). Treat these as suspicious; do not rely on them. If you intend to use the skill, supply your own LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, and LANGFUSE_HOST via environment variables and remove/override any hard-coded secrets. If those embedded secrets are valid, they represent a credential leak. - Data exfiltration risk: The skill will send traces (prompts, completions, API/tool inputs/outputs, metadata) to LANGFUSE_HOST. Ensure that the target host is under your control (or trusted). Redact PII/sensitive contents before tracing, or disable tracing of sensitive fields, because traces may contain secrets or user data. - Operational testing: Run the skill in a sandboxed environment first (no network or pointing to a test Langfuse instance) to verify behavior and dependency requirements. - If you don't control the Langfuse endpoint or can't confirm the keys are safe, do not enable autonomous invocations. Review and remove hard-coded secrets and add explicit documentation of required env vars and dependency installation before production use. What would change this assessment: if the publisher updated the skill to (1) declare required environment variables and not embed secret defaults, (2) include or document a safe install step for the Langfuse SDK, and (3) clearly document what data is sent and how to redact it, the concerns would be resolved and the skill could be reclassified as benign.

Type: OpenClaw Skill Name: langfuse-observability Version: 1.0.0 The skill bundle provides a Langfuse observability toolkit but contains hardcoded sensitive credentials (LANGFUSE_SECRET_KEY) in langfuse_hub.py, langfuse_admin.py, and langfuse_cron.py. While the code appears functional for its stated purpose of tracing LLM calls and tool executions, the inclusion of static API keys is a significant security vulnerability. Additionally, the toolkit is designed to capture and transmit all agent interactions (prompts, completions, and metadata) to a configured host (defaulting to http://langfuse-web:3000), which could lead to data exposure if the endpoint is not properly secured or is redirected.