evaluating-code-models
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the BigCode Evaluation Harness from its official GitHub repository and retrieves Docker images from the GitHub Container Registry.
- [REMOTE_CODE_EXECUTION]: Executes code generated by AI models to assess functional correctness (pass@k metrics) when the
--allow_code_executionflag is enabled in the harness. - [INDIRECT_PROMPT_INJECTION]: The skill processes and executes untrusted code generated by external AI models as part of the benchmarking process.
- Ingestion points: Model-generated code solutions loaded from
generations.jsonor generated during evaluation inSKILL.mdandreferences/benchmarks.md. - Boundary markers: None; model outputs are treated as executable code snippets.
- Capability inventory: Full code execution capability via
accelerate launch main.pyand thecode_evalmetric as documented inreferences/custom-tasks.md. - Sanitization: None within the skill scripts; however, the skill documentation strongly advises using Docker for isolated execution to mitigate risks.
- [DYNAMIC_EXECUTION]: Employs dynamic execution (
exec) to run generated code snippets against benchmark unit tests. - [COMMAND_EXECUTION]: Includes instructions for using the
--trust_remote_codeflag, which allows the execution of custom scripts embedded in Hugging Face model repositories.
Audit Metadata