coval-eval-start
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, specifically the output of the
covalCLI tool (e.g.,coval --agent). This represents a potential surface for indirect prompt injection if the evaluation data contains instructions aimed at the agent. - Ingestion points: The skill processes results from
coval --agentcommands which return payloads wrapped indatablocks. - Boundary markers: None explicitly defined for prompt interpolation.
- Capability inventory: Execution of
covalCLI and routing to other installed skills. - Sanitization: The skill checks for command success via exit codes and
okflags in payloads. - [COMMAND_EXECUTION]: The skill utilizes the
covalCLI to check environment health and resource inventory. These commands (coval --version,coval --agent agent doctor) are standard for the tool's intended use and the skill explicitly forbids sensitive operations like printing API keys.
Audit Metadata