behavioral-evals

The skill was analyzed for all 11 threat categories, including prompt injection, data exfiltration, and remote code execution. No malicious patterns were identified. The following observations were made during the analysis:

• Credential Safety: The skill follows best practices by instructing users to manage API keys via environment variables or .env files rather than hardcoding them.
• Trusted Sources: All external links and repository references are to the official google-gemini GitHub organization, which is a trusted vendor.
• Command Execution: The shell commands provided (e.g., for running vitest) are necessary for the skill's primary purpose of executing tests and do not perform any hidden or malicious actions.
• Information Exposure: A local file path reference was found in the documentation (file:///Users/abhipatel/...). While this exposes a local username and directory structure from the author's environment, it is not a sensitive file access and does not pose a threat to the user.