eval-author-inspect-trace
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external data including Intake trace payloads and evaluator comments. This content is treated as untrusted, but it is interpolated into reports, presenting a surface where malicious instructions embedded in the traces could attempt to influence the agent's summary or assessment. \n
- Ingestion points: Trace rollups, span payloads, and evaluator results fetched via the nemo CLI. \n
- Boundary markers: The skill uses a structured Markdown template and instructions to separate observations from interpretations. \n
- Capability inventory: Bash, Read, and Write tools used to run CLI commands and save report files. \n
- Sanitization: Character replacement for trace IDs in filenames and omission of credentials in error reports.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute nemo CLI commands for listing and retrieving trace data. It follows a specific resolution order for the CLI binary and includes instructions to avoid unauthorized actions like installation or environment modification.\n- [DATA_EXFILTRATION]: The skill reads local repository files and remote trace data to perform its analysis. While this involves accessing trace information (durations, costs, models) and source symbols, these actions are central to the skill's primary purpose. The skill instructions specifically mandate that credentials must not be printed or saved.
Audit Metadata