deepeval

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The maintenance script scripts/check-updates.py connects to the official PyPI API (pypi.org) to retrieve the latest version information for the deepeval package. This is a standard administrative operation involving a well-known technology service.
  • [COMMAND_EXECUTION]: Documentation throughout the reference files describes the use of CLI tools such as deepeval test run, deepeval login, and deepeval generate. These commands are legitimate features for executing tests, authenticating with the developer platform, and generating synthetic data.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from JSON, JSONL, and CSV files for evaluation purposes. While this creates a surface for indirect prompt injection, the documentation also includes dedicated safety metrics (such as MisuseMetric and ToxicityMetric) designed to detect and audit for such vulnerabilities in LLM systems.
  • [DYNAMIC_EXECUTION]: A code example in references/08-tracing.md demonstrates a simple calculator tool using Python's eval() function. This is provided as an illustrative pedagogical example for classifying span types in the tracing system and is not an instruction to perform unsafe code execution on untrusted input.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:30 AM
Security Audit — agent-trust-hub — deepeval