phoenix-verify
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is authored by arize-ai and utilizes its own official ecosystem tools, including the arize-phoenix server and the @arizeai/phoenix-cli. These resources are consistent with the skill's purpose and are from a recognized source.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and execute packages using standard managers such as npx, pnpm, and uv. These downloads target official registries (npm, PyPI) for tools required by the verification workflow.
- [COMMAND_EXECUTION]: The skill automates tasks using shell commands, build tools (Gradle), and runtime environments (Node.js, Python). These operations are confined to the user's local development environment and are used to build and test code examples.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests telemetry data from a local Phoenix instance. While this represents a data ingestion surface, the risk is managed as the data originates from locally executed code examples, and the skill performs standard JSON parsing and filtering via jq.
Audit Metadata