deepeval
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The maintenance script
scripts/check-updates.pyconnects to the official PyPI API (pypi.org) to retrieve the latest version information for thedeepevalpackage. This is a standard administrative operation involving a well-known technology service. - [COMMAND_EXECUTION]: Documentation throughout the reference files describes the use of CLI tools such as
deepeval test run,deepeval login, anddeepeval generate. These commands are legitimate features for executing tests, authenticating with the developer platform, and generating synthetic data. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from JSON, JSONL, and CSV files for evaluation purposes. While this creates a surface for indirect prompt injection, the documentation also includes dedicated safety metrics (such as
MisuseMetricandToxicityMetric) designed to detect and audit for such vulnerabilities in LLM systems. - [DYNAMIC_EXECUTION]: A code example in
references/08-tracing.mddemonstrates a simple calculator tool using Python'seval()function. This is provided as an illustrative pedagogical example for classifying span types in the tracing system and is not an instruction to perform unsafe code execution on untrusted input.
Audit Metadata