skills/axiomhq/skills/writing-evals/Gen Agent Trust Hub

writing-evals

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several bash scripts in the scripts/ directory that perform command-line operations. Specifically, scripts/eval-run, scripts/eval-list, and scripts/eval-validate invoke npx axiom eval to execute evaluations, while scripts/eval-scaffold uses sed to perform string replacements in templates and redirects the output to create new files. Additionally, scripts/eval-results attempts to execute axiom-query, a script from the related axiom-sre skill, using expected local installation paths.
  • [DYNAMIC_EXECUTION]: The scripts/eval-scaffold utility generates TypeScript evaluation files (.eval.ts) by populating pre-defined templates with capability and step names. This represents standard code generation for developer tooling and does not involve executing untrusted remote code.
  • [EXTERNAL_DOWNLOADS]: The documentation and scripts recommend installing the axiom SDK and zod library via standard package managers like npm or pnpm. It also references the command npx skills add axiomhq/skills for installation, which is consistent with the skill's intended deployment model.
  • [PROMPT_INJECTION]: Although static analysis flagged potential injection patterns, these are evaluated as benign. In SKILL.md, instructions to prioritize local SDK documentation are provided to ensure accuracy. In the evaluation templates, phrases like "ignore previous instructions" are explicitly used as examples for adversarial test cases to help developers test the robustness of their AI models, rather than attempting to subvert the agent's internal behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:50 PM