dspy-evaluation-harness

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill handles natural language inputs (questions and answers) through DSPy programs and evaluation metrics. This creates a vulnerability surface where instructions embedded in the data could influence model behavior or aggregate metric calculations.
  • Ingestion points: dspy.Example objects in SKILL.md and example_metric.py ingest arbitrary strings for processing.
  • Boundary markers: The provided examples do not use delimiters or explicit instructions to isolate user data from program logic.
  • Capability inventory: The skill uses dspy.LM for model interaction and dspy.Evaluate for result aggregation, providing a mechanism for instructions in the data to influence execution.
  • Sanitization: No input validation or filtering is implemented in the provided code snippets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:02 PM