Skip to content
Back to skills

Langchain

ASecurity

Build LangChain LCEL, tool, and retrieval workflows with explicit memory boundaries and application structure.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 22, 2026
ai-agentspythonrustgoshellrailsapi

Works with

  • cursor
  • api

Security analysis

A100/100

Scanned October 22, 2026

npx -y skills add alivirgo/Major-AI-Skills --skill langchain --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Langchain?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Langchain
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/alivirgo-langchain/badge)](https://www.skillsdirectory.com/skills/alivirgo-langchain)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: langchain
description: "Build LangChain LCEL, tool, and retrieval workflows with explicit memory boundaries and application structure."
category: development
risk: safe
source: self
source_type: self
date_added: "2026-08-26"
tags: ["langchain", "llm", "agents", "rag", "python", "claude"]
tools: ["claude", "cursor", "gemini", "codex"]
---

# LangChain LLM Apps AI Skill Guide

## Overview & Engine Architecture

LangChain composes prompts, models, retrievers, and tools into runnable chains (LCEL). LCEL pipes (`|`) build DAGs of `Runnable` steps with batch/stream/async support. Agents keep prompts versioned, constrain tool permissions, ground answers with retrieval when facts matter, and treat model I/O as untrusted until validated.

```
Prompt -> Model -> OutputParser
           ^
           |
     Retriever / Tools
```

## When to use this skill

- RAG chat and tool-calling assistants in Python
- Rapid composition of prompt + model + parser pipelines
- Glue between `@openai-api` / `@anthropic-api` and vector stores

## Operational directives

1. Prefer LCEL runnables over legacy LLMChain patterns for new code.
2. Bound agent tool sets; never expose shell/FS tools without review.
3. Separate system instructions, retrieved context, and user text clearly.
4. Log prompts/completions with redaction - do not leak secrets into traces.
5. Pin package extras (`langchain-openai`, etc.) and model names explicitly.

## LCEL RAG sketch

```python
from langchain_openai import ChatOpenAI
from langchain_core.prompts import ChatPromptTemplate
from langchain_core.runnables import RunnablePassthrough
from langchain_core.output_parsers import StrOutputParser

prompt = ChatPromptTemplate.from_messages([
    ("system", "Answer using only the context. If unknown, say you do not know.\n\n{context}"),
    ("human", "{question}"),
])

llm = ChatOpenAI(model="gpt-4.1-mini", temperature=0)

chain = (
    {"context": retriever, "question": RunnablePassthrough()}
    | prompt
    | llm
    | StrOutputParser()
)

print(chain.invoke("What is our refund window?"))
```

## Tool calling hygiene

```python
# Expose only pure, side-effect-reviewed callables
# Validate tool args; set timeouts; deny network where unused
```

## Common failures

| Symptom | Cause | Fix |
| --- | --- | --- |
| Hallucinated citations | weak retrieval / no grounding rule | tighter prompt; cite chunks |
| Import errors | split packages | install provider extras |
| Runaway agents | unlimited tool loops | max iterations; allowlists |
| Flaky evals | temperature > 0 | temp=0 for tests; golden sets |

## Best practices

- Evaluate with fixed question sets before UX polish.
- Store embeddings/docs in `@chromadb` / cloud vector DBs with metadata filters.
- Stream tokens for UX; batch for offline jobs.
- Keep business logic in plain Python modules - chains should stay thin.

## Limitations

- APIs churn across LangChain majors; pin versions.
- Not a substitute for proper authZ on tools and data sources.
- Complex agents still need product-level guardrails and human escalation.

## Related skills

- `@llamaindex` - retrieval-first alternative framework
- `@chromadb` - local vector store
- `@openai-api` / `@anthropic-api` - provider SDKs

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.