eval-harness

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill outlines a structured methodology for implementing evaluation-driven development (EDD) within AI-assisted workflows. It defines templates and metrics such as pass@k to track agent reliability and ensure quality control across development cycles.- [COMMAND_EXECUTION]: The framework includes examples of local command execution using the Bash tool for verification tasks, such as npm test, npm run build, and grep. These are standard, deterministic checks used in software development to validate code state and run unit tests.- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing evaluation definitions and success criteria stored in the .claude/evals/ directory.
  • Ingestion points: Evaluation files and run history logs located in the project's .claude/evals/ directory.
  • Boundary markers: The templates do not explicitly define boundary markers or 'ignore' instructions for content processing.
  • Capability inventory: The skill utilizes Bash, Read, Write, Edit, Grep, and Glob tools across its lifecycle.
  • Sanitization: No specific sanitization or validation logic is documented for the eval artifacts.
  • Assessment: While this represents a potential injection surface if an attacker controls the project files, the framework is designed for internal development use, making the risk profile consistent with standard development tooling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:24 AM