llm-evaluation
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill's implementation of the 'LLM-as-Judge' pattern is vulnerable to indirect prompt injection because it interpolates untrusted data (the model outputs being evaluated) directly into the judge's prompt template.
- Ingestion points: Model outputs are ingested via the
response,response_a, andresponse_bparameters in functionsllm_judge_qualityandcompare_responseswithinSKILL.md. - Boundary markers: Absent. The code uses standard f-string interpolation without delimiters (such as XML tags or triple backticks) or instructions for the judge to ignore embedded instructions.
- Capability inventory: The evaluated content is passed to
openai.ChatCompletion.create. No shell execution or persistent file system operations are triggered by this process. - Sanitization: The skill does not perform any sanitization, escaping, or filtering of the model responses before placing them in the prompt.
Audit Metadata