skill-trace-evaluation
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation and evaluation framework designed to help developers assess and improve the quality of AI agent skills. It follows established community guidelines.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script,
scripts/trace_evaluate.py, to perform static analysis on a target skill's directory. This script performs benign operations such as counting files, checking for the existence of specific sections (like FAQ and Gotchas), and scanning for potential hardcoded secrets using regular expressions. These operations are restricted to the directory provided by the user. - [DATA_EXFILTRATION]: No unauthorized network activity or data exfiltration patterns were identified. The skill generates local reports and uses a well-known CDN (Tailwind CSS) in its HTML report template for styling.
- [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted text from other skills' SKILL.md files, which creates a potential surface for indirect prompt injection. However, the evaluation framework includes strict calibration constraints—limiting the AI's scoring adjustment to ±0.3—and requires specific evidence citations in the output to mitigate the risk of an untrusted document overriding the evaluator's logic.
Audit Metadata