evaluating-with-promptfoo
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The
references/RED-TEAMING.mdfile lists adversarial techniques like 'auto-dan' and 'jailbreak:meta'. These are documented as plugins for the promptfoo tool to allow developers to test their own models against such attacks, rather than being malicious injections within the skill itself.\n- [COMMAND_EXECUTION]: The skill provides documentation for executing variouspromptfooCLI commands (e.g.,promptfoo eval,promptfoo redteam run). These instructions guide users on how to operate the toolkit locally and in CI/CD environments like GitHub Actions and Jenkins.\n- [EXTERNAL_DOWNLOADS]: The instructions include steps to install thepromptfooutility via official package managers such as npm and Homebrew. This is a standard installation procedure for this well-known open-source tool.\n- [DATA_EXFILTRATION]: Documentation withinreferences/CI-CD.mdpromotes the use of environment variables for API keys and includes specific configuration options (e.g.,PROMPTFOO_STRIP_RESPONSE_OUTPUT) to prevent sensitive data from being logged in public CI/CD runners.
Audit Metadata