SkillTotal

Is langchain-openai safe?

No malicious indicators - review capabilities before installing
Notable — review in context (capabilities are not malware):
  • Python network egress
  • Python filesystem read
  • Delegated authentication (OAuth 2.0 / OIDC)

langchain-openai is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 3 risky constructs are reported for review. It can: delegated authentication, filesystem read and network egress — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).

langchain-openai 1.5.1

python_package · pypi:langchain-openai
LOW
0
/ 100 risk score
Snapshot · scanned Aug 15, 2026 · langchain-openai@1.5.1 · engine 0.38.1 / ruleset 42

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of langchain-openai's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):
delegated authenticationfilesystem readnetwork egress

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Filesystem reach
Tool Execution Context
Network egress
Interaction & Communication / Direct Communication
Delegated authentication
Tool Execution Context / User Delegated Credentials

Findings (3)

MEDIUMPython filesystem readST-FS-PY-READ

The component reads files from disk.

raw_text = self.path.read_text(encoding="utf-8")
content = pyproject_path.read_text(encoding="utf-8")
content = version_path.read_text(encoding="utf-8")

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMPython network egressST-NET-PY

The component makes outbound network requests.

return bool(urllib.request.getproxies())
detected = bool(urllib.request.getproxies())
from urllib.parse import urlparse
with httpx.Client(timeout=timeout) as client:
with httpx.Client(timeout=timeout) as client:
async with httpx.AsyncClient(timeout=timeout) as client:
return f"{CHATGPT_AUTHORIZE_URL}?{urllib.parse.urlencode(params)}"
parsed = urllib.parse.urlparse(self.path)
query = urllib.parse.parse_qs(parsed.query)

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

LOWDelegated authentication (OAuth 2.0 / OIDC)ST-AUTH-DELEGATED

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (25 occurrence(s) shown as evidence).

CHATGPT_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize"
`plan_type`, `user_id`) are populated when decodable from the `id_token`;
`id_token` itself is the raw token, not derived from it. Secret-bearing
fields (`access_token`, `refresh_token`, `id_token`) are excluded from the
id_token: str | None = field(default=None, repr=False)
def _extract_chatgpt_claims(id_token: str | None) -> dict[str, str | None]:
claims = decode_jwt_claims(id_token)
# A present-but-unparseable id_token (or one missing the namespaced
"id_token; the `ChatGPT-Account-Id` header will be omitted."
id_token = payload.get("id_token")
claims = _extract_chatgpt_claims(id_token)
id_token=data.get("id_token"),
"grant_type": "refresh_token",
"grant_type": "authorization_code",
"grant_type": "authorization_code",

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →