fit-benchmark
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The harness is designed to execute shell scripts provided within the task family structure, specifically
hooks/preflight.shandhooks/invariants.sh. These scripts run on the host machine to prepare the environment and validate results. - [EXTERNAL_DOWNLOADS]: The CLI supports using git URLs for the
--familyflag, which allows the tool to download benchmark task families from remote repositories. This involves subsequent execution of shell scripts contained within those downloaded repositories. - [DATA_EXPOSURE]: The tool automatically discovers and loads
.envand.env.localfiles from the task directories into the environment. It includes a documented safety feature that adds discovered variable names to a redaction allowlist to prevent accidental leakage in agent traces. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of task prompts (
agent.task.md,judge.task.md) and renders them into templates. It defines a capability surface for the agent under test that includesBash,Write, andEdittools. However, the tool is specifically designed to isolate grading logic (hidden tests) from the agent's working directory to maintain evaluation integrity.
Audit Metadata