opik-compare

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically generate a temporary Python script (a "throwaway runner") to interface the repository's code with the Opik SDK. This involves grepping the codebase for specific entrypoint functions, importing them into the generated script, and executing them locally. The skill advises writing this file outside the repository to prevent it from being committed to version control.
  • [INDIRECT_PROMPT_INJECTION]: By summarizing experimental outputs and test traces, the skill exposes the agent to untrusted data generated by LLM models. While the instructions focus on aggregating pass rates and identifying regression reasons, malicious content within test cases could theoretically influence the agent's summary or subsequent actions. No sanitization logic is explicitly defined for these ingested outputs.
  • [COMMAND_EXECUTION]: The skill requires the Bash tool to execute the dynamically generated runner and interact with the Opik command-line interface and environment variables.
  • [EXTERNAL_DOWNLOADS]: The skill relies on the opik SDK to communicate with Comet.ml's infrastructure. It fetches test suites and experiment data from remote servers and uploads evaluation results. These operations are performed using the user's configured credentials (e.g., OPIK_API_KEY) and target official vendor domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 09:53 PM