skillgrade-setup
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
skillgradepackage globally via npm to provide the evaluation CLI tool. - [COMMAND_EXECUTION]: The procedures involve running the
skillgradeCLI for initializing, running, and previewing evaluation results. - [COMMAND_EXECUTION]: The
eval.yamlconfiguration specification allows users to define shell commands for Docker environment setup and for running deterministic grading scripts. - [PROMPT_INJECTION]: The skill documentation describes an attack surface for indirect prompt injection as it processes untrusted instructions and rubrics from configuration files (Ingestion points:
eval.yamlfieldsinstructionandrubric). No boundary markers are explicitly defined in the documentation. The tool possesses command execution capabilities (Capability inventory:runandsetupcommands ineval.yaml). No sanitization or filtering logic is specified.
Audit Metadata