nemo-evaluator-plugin

The artifact configures an LLM evaluation against NVIDIA’s chat-completions API and computes metrics using embedded cloudpickle-serialized metric evaluators. No explicit malicious behavior or suspicious network destinations are shown, but the inclusion of cloudpickle payloads creates a significant supply-chain risk: if the evaluation runner unpickles these blobs, arbitrary code execution is possible under tampering or unsafe loading. Treat this as a security review requirement for deserialization provenance/integrity and sandboxing controls.