skill-eval

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/eval_runner.py uses subprocess.run to execute various commands including git, claude, and codex. This is the core functionality of the skill (an evaluation runner). The implementation includes safety features such as concurrency limits, hard timeouts, and path validation to ensure execution stays within defined sandbox directories. Arguments are passed as lists to prevent shell injection, and sensitive environment variables (like GIT_DIR or CLAUDECODE session keys) are explicitly stripped or sanitized before spawning child processes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 01:33 AM
Security Audit — agent-trust-hub — skill-eval