cekura-metric-design
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive design guide for Cekura voice AI metrics. It includes instructional content, prompt templates, and Python examples for custom evaluation logic.
- [REMOTE_CODE_EXECUTION]: While the skill mentions Python code running on AWS Lambda for
custom_codemetrics, this is a native feature of the Cekura platform for metric evaluation. The provided Python examples (e.g.,examples/custom-code-metric.py) demonstrate benign logic such as string manipulation, regex-based section extraction, and standard platform API calls (evaluate_basic_metric). - [DATA_EXFILTRATION]: The skill uses official Cekura API endpoints (
api.cekura.ai) for legitimate platform operations such as fetching transcripts and updating metric configurations. These operations are scoped to the vendor's own infrastructure and are necessary for the skill's intended purpose. - [PROMPT_INJECTION]: The skill provides templates for 'LLM Judge' prompts. These are used for back-end evaluation of call transcripts and do not attempt to bypass the primary agent's safety filters or override system behavior in a malicious way. The instructions focus on improving evaluation accuracy.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill correctly instructs users to use standard authentication methods (OAuth or API keys) provided by the platform.
- [DYNAMIC_CONTEXT_INJECTION]: The skill does not use any dynamic shell execution patterns in its documentation or configuration files.
Audit Metadata