evals-validate

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several command-line tools to perform its primary function, including npx promptfoo for prompt evaluation and pytest for executing DeepEval tests.
  • [DYNAMIC_EXECUTION]: The skill explicitly runs a local Python script located at evals/deepeval/config.py to facilitate evaluation execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from JSON files located in evals/results/. These files contain the output of AI evaluations, which may include untrusted content from the models being tested.
  • Ingestion points: Evaluation results in JSON format read from evals/results/ (SKILL.md).
  • Boundary markers: No specific delimiters or safety instructions are defined for the parsing of these results.
  • Capability inventory: The skill possesses the ability to execute shell commands (npx, pytest, python) and write files to the local filesystem (evals/results/validation_report.md).
  • Sanitization: There is no evidence of sanitization or validation of the content within the results JSON files before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 05:02 PM