evaluation

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documents contain high-risk operational instructions that explicitly enable remote code execution (deployment.pre_cmd, curl/pip installs, --trust-remote-code, and the NEMO_EVALUATOR_TRUST_PRE_CMD toggle) and describe a transcript/mirroring behavior that can leak secrets from .env, together creating clear vectors for backdoor execution and data exfiltration if abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow can fetch and ingest OUTSIDER-authored free text from public web content (e.g., “Searches the web for the model card on HuggingFace” and “Fetch the page for the EXACT model id” from recipes.vllm.ai) into the agent’s LLM context to extract sampling/context/output-length settings.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching external model cards and recipe pages at runtime (e.g. https://huggingface.co/... for model cards and https://recipes.vllm.ai/... for vLLM recipes) and even suggests runtime curl/pip pre_cmd downloads (example: curl ...huggingface.co/.../reasoning_parser.py) whose content is used to set prompts/flags or to execute code, so these external URLs directly control agent behavior or run code.