promptfoo

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the promptfoo package from the npm registry using npm install -g promptfoo or npx promptfoo@latest. This is a standard installation procedure for a well-known developer tool.
  • [COMMAND_EXECUTION]: The skill uses several CLI commands for its primary functionality, including promptfoo eval for running evaluations, promptfoo view for displaying results in a web UI, and promptfoo redteam for security testing. These are expected behaviors for a command-line utility.
  • [COMMAND_EXECUTION]: The evaluation configuration includes a javascript assertion type (e.g., output.length < 500). This is a documented feature of the Promptfoo framework used to perform custom validation on LLM outputs using local code execution.
  • [CREDENTIALS_UNSAFE]: The skill correctly demonstrates best practices for credential management in the CI Integration section by using GitHub Actions secrets (${{ secrets.OPENAI_API_KEY }}) rather than hardcoding sensitive information.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 12:56 PM
Security Audit — agent-trust-hub — promptfoo