evaluating-with-promptfoo

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [PROMPT_INJECTION]: The references/RED-TEAMING.md file lists adversarial techniques like 'auto-dan' and 'jailbreak:meta'. These are documented as plugins for the promptfoo tool to allow developers to test their own models against such attacks, rather than being malicious injections within the skill itself.\n- [COMMAND_EXECUTION]: The skill provides documentation for executing various promptfoo CLI commands (e.g., promptfoo eval, promptfoo redteam run). These instructions guide users on how to operate the toolkit locally and in CI/CD environments like GitHub Actions and Jenkins.\n- [EXTERNAL_DOWNLOADS]: The instructions include steps to install the promptfoo utility via official package managers such as npm and Homebrew. This is a standard installation procedure for this well-known open-source tool.\n- [DATA_EXFILTRATION]: Documentation within references/CI-CD.md promotes the use of environment variables for API keys and includes specific configuration options (e.g., PROMPTFOO_STRIP_RESPONSE_OUTPUT) to prevent sensitive data from being logged in public CI/CD runners.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 11:13 PM
Security Audit — agent-trust-hub — evaluating-with-promptfoo