dspy-evaluation-harness
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill handles natural language inputs (questions and answers) through DSPy programs and evaluation metrics. This creates a vulnerability surface where instructions embedded in the data could influence model behavior or aggregate metric calculations.
- Ingestion points:
dspy.Exampleobjects inSKILL.mdandexample_metric.pyingest arbitrary strings for processing. - Boundary markers: The provided examples do not use delimiters or explicit instructions to isolate user data from program logic.
- Capability inventory: The skill uses
dspy.LMfor model interaction anddspy.Evaluatefor result aggregation, providing a mechanism for instructions in the data to influence execution. - Sanitization: No input validation or filtering is implemented in the provided code snippets.
Audit Metadata