vally-tests
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- Safety Refusal Taxonomy: The skill implements a detailed safety framework in
references/refusal-taxonomy.md. This taxonomy defines categories such as jailbreaking, prompt injection, and PII extraction, providing specific regular expressions to identify and refuse requests that violate safety policies. - Proactive Security Linting: Scripts such as
import_corpus.pyandLint-VallyTestSafety.ps1are used to automatically validate external inputs (CSV or XLSX) against the safety taxonomy. This ensures that only benign conformance tests are generated and integrated into the evaluation suites. - Secure Data Integration: The skill handles external data inputs with significant care. The
import_corpus.pyscript uses proper YAML scalar escaping (viajson.dumps) to prevent data-driven structural injection when generating test suites from external spreadsheets. - Controlled Execution Environment: Subprocess calls used for linting are implemented securely using argument lists rather than shell strings. This prevents command injection and restricts the execution to internal scripts for the sole purpose of security verification.
- Integrity and Deduplication: The skill employs SHA-256 hashing to normalize and deduplicate test prompts, ensuring that the test suites remain stable, concise, and verifiable.
Audit Metadata