rag-eval
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the agent's shell capabilities to run local evaluation scripts (
scripts/eval/evaluate_rag.py) viauvorpython3. These commands are used to process local datasets and generate quality metrics. - [EXTERNAL_DOWNLOADS]: The skill uses the
uvpackage manager to synchronize dependencies as defined in the repository's project files. It also interacts with a RAG server and hosted LLM endpoints for RAGAS evaluation, which is a standard part of the benchmarking workflow. - [CREDENTIALS_UNSAFE]: While the skill requires an
NVIDIA_API_KEYfor evaluation services, it includes comprehensive instructions on credential hygiene. It specifically advises users to use environment files, gitignore, and secrets managers while warning against committing keys or leaving them in shell history. - [SAFE]: The skill processes user-provided data from the local
corpus/directory. Although processing external content represents a surface for indirect prompt injection, the skill's operations are confined to benchmarking retrieval and generation quality and do not involve high-risk actions based on the processed data.
Audit Metadata