writing-evals
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several bash scripts in the
scripts/directory that perform command-line operations. Specifically,scripts/eval-run,scripts/eval-list, andscripts/eval-validateinvokenpx axiom evalto execute evaluations, whilescripts/eval-scaffoldusessedto perform string replacements in templates and redirects the output to create new files. Additionally,scripts/eval-resultsattempts to executeaxiom-query, a script from the relatedaxiom-sreskill, using expected local installation paths. - [DYNAMIC_EXECUTION]: The
scripts/eval-scaffoldutility generates TypeScript evaluation files (.eval.ts) by populating pre-defined templates with capability and step names. This represents standard code generation for developer tooling and does not involve executing untrusted remote code. - [EXTERNAL_DOWNLOADS]: The documentation and scripts recommend installing the
axiomSDK andzodlibrary via standard package managers likenpmorpnpm. It also references the commandnpx skills add axiomhq/skillsfor installation, which is consistent with the skill's intended deployment model. - [PROMPT_INJECTION]: Although static analysis flagged potential injection patterns, these are evaluated as benign. In
SKILL.md, instructions to prioritize local SDK documentation are provided to ensure accuracy. In the evaluation templates, phrases like "ignore previous instructions" are explicitly used as examples for adversarial test cases to help developers test the robustness of their AI models, rather than attempting to subvert the agent's internal behavior.
Audit Metadata