llm-regression-suite-author
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured guidance and boilerplate code for LLM regression testing, utilizing well-known and reputable tools such as promptfoo and DeepEval.
- [COMMAND_EXECUTION]: The skill includes instructions for executing evaluation CLI tools and a Python helper script to compare results. These commands are standard for the described workflow and operate on locally generated data within a controlled environment (local machine or CI runner).
- [DATA_EXPOSURE]: The skill documentation correctly demonstrates the use of GitHub Secrets for managing API credentials (
${{ secrets.OPENAI_API_KEY }}), which is a recommended security practice for CI/CD pipelines. - [INDIRECT_PROMPT_INJECTION]: As an evaluation tool, the skill naturally ingests external data (golden datasets) to be processed by an LLM. While this is an attack surface, the skill is designed for testing and quality assurance rather than production automated workflows, and the usage of deterministic assertions acts as a validation layer.
Audit Metadata