promptfoo
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
promptfoopackage from the npm registry usingnpm install -g promptfooornpx promptfoo@latest. This is a standard installation procedure for a well-known developer tool. - [COMMAND_EXECUTION]: The skill uses several CLI commands for its primary functionality, including
promptfoo evalfor running evaluations,promptfoo viewfor displaying results in a web UI, andpromptfoo redteamfor security testing. These are expected behaviors for a command-line utility. - [COMMAND_EXECUTION]: The evaluation configuration includes a
javascriptassertion type (e.g.,output.length < 500). This is a documented feature of the Promptfoo framework used to perform custom validation on LLM outputs using local code execution. - [CREDENTIALS_UNSAFE]: The skill correctly demonstrates best practices for credential management in the CI Integration section by using GitHub Actions secrets (
${{ secrets.OPENAI_API_KEY }}) rather than hardcoding sensitive information.
Audit Metadata