configure-metrics
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several commands via the
covalCLI to manage metric and agent resources. These includecoval whoami,coval login,coval metrics list,coval metrics create, andcoval agents update. These operations are consistent with the skill's primary purpose of configuring evaluation infrastructure. - [EXTERNAL_DOWNLOADS]: The skill directs users to the official vendor domains
coval.devandapp.coval.devfor account management and API key retrieval. These are trusted sources associated with the skill author. - [PROMPT_INJECTION]: The skill implements a feature where user-provided requirements are interpolated into LLM-based evaluation prompts in Phase 4.
- Ingestion points: User input for the "critical requirement" field in
SKILL.md. - Boundary markers: None. The requirement is inserted directly into a string template: "Given the transcript, did the agent satisfy this requirement: <user_requirement>?".
- Capability inventory: The skill uses the
coval metrics createcommand to register the generated prompt logic. - Sanitization: None. User input is used verbatim in the prompt and description fields. However, as this is the intended functionality of the custom metric creation feature, it is documented here as a surface rather than a malicious vector.
Audit Metadata