evals-validate
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several command-line tools to perform its primary function, including
npx promptfoofor prompt evaluation andpytestfor executing DeepEval tests. - [DYNAMIC_EXECUTION]: The skill explicitly runs a local Python script located at
evals/deepeval/config.pyto facilitate evaluation execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from JSON files located in
evals/results/. These files contain the output of AI evaluations, which may include untrusted content from the models being tested. - Ingestion points: Evaluation results in JSON format read from
evals/results/(SKILL.md). - Boundary markers: No specific delimiters or safety instructions are defined for the parsing of these results.
- Capability inventory: The skill possesses the ability to execute shell commands (
npx,pytest,python) and write files to the local filesystem (evals/results/validation_report.md). - Sanitization: There is no evidence of sanitization or validation of the content within the results JSON files before processing.
Audit Metadata