configure-metrics

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several commands via the coval CLI to manage metric and agent resources. These include coval whoami, coval login, coval metrics list, coval metrics create, and coval agents update. These operations are consistent with the skill's primary purpose of configuring evaluation infrastructure.
  • [EXTERNAL_DOWNLOADS]: The skill directs users to the official vendor domains coval.dev and app.coval.dev for account management and API key retrieval. These are trusted sources associated with the skill author.
  • [PROMPT_INJECTION]: The skill implements a feature where user-provided requirements are interpolated into LLM-based evaluation prompts in Phase 4.
  • Ingestion points: User input for the "critical requirement" field in SKILL.md.
  • Boundary markers: None. The requirement is inserted directly into a string template: "Given the transcript, did the agent satisfy this requirement: <user_requirement>?".
  • Capability inventory: The skill uses the coval metrics create command to register the generated prompt logic.
  • Sanitization: None. User input is used verbatim in the prompt and description fields. However, as this is the intended functionality of the custom metric creation feature, it is documented here as a surface rather than a malicious vector.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 07:05 PM
Security Audit — agent-trust-hub — configure-metrics