eval-harness
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing shell commands via the Bash tool to perform deterministic grading. These commands are typically defined in .claude/evals/ files and executed when the agent runs an evaluation workflow.
- [COMMAND_EXECUTION]: The Code-Based Grader section explicitly demonstrates running shell scripts like npm test or grep. While intended for testing, this pattern allows for the execution of arbitrary code if the evaluation files themselves are modified or provided by an untrusted source.
- [PROMPT_INJECTION]: The skill establishes a vulnerability surface for indirect prompt injection by ingesting and acting upon instructions found in project files.
- Ingestion points: Untrusted data enters the agent context through evaluation definition files located at .claude/evals/.md and history logs at .claude/evals/.log.
- Boundary markers: The framework does not specify the use of clear boundary markers or system-level instructions to ignore embedded commands within the processed markdown files.
- Capability inventory: The skill provides access to high-privilege tools including Bash, Write, Edit, and Grep.
- Sanitization: There is no evidence of content validation or sanitization for the content read from external files before it is used to influence the agent's logic or executed as code.
Audit Metadata