skills/nvidia/skills/rag-eval/Gen Agent Trust Hub

rag-eval

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the agent's shell capabilities to run local evaluation scripts (scripts/eval/evaluate_rag.py) via uv or python3. These commands are used to process local datasets and generate quality metrics.
  • [EXTERNAL_DOWNLOADS]: The skill uses the uv package manager to synchronize dependencies as defined in the repository's project files. It also interacts with a RAG server and hosted LLM endpoints for RAGAS evaluation, which is a standard part of the benchmarking workflow.
  • [CREDENTIALS_UNSAFE]: While the skill requires an NVIDIA_API_KEY for evaluation services, it includes comprehensive instructions on credential hygiene. It specifically advises users to use environment files, gitignore, and secrets managers while warning against committing keys or leaving them in shell history.
  • [SAFE]: The skill processes user-provided data from the local corpus/ directory. Although processing external content represents a surface for indirect prompt injection, the skill's operations are confined to benchmarking retrieval and generation quality and do not involve high-risk actions based on the processed data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 07:42 PM
Security Audit — agent-trust-hub — rag-eval