eval-harness
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill outlines a structured methodology for implementing evaluation-driven development (EDD) within AI-assisted workflows. It defines templates and metrics such as pass@k to track agent reliability and ensure quality control across development cycles.- [COMMAND_EXECUTION]: The framework includes examples of local command execution using the Bash tool for verification tasks, such as
npm test,npm run build, andgrep. These are standard, deterministic checks used in software development to validate code state and run unit tests.- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing evaluation definitions and success criteria stored in the.claude/evals/directory. - Ingestion points: Evaluation files and run history logs located in the project's
.claude/evals/directory. - Boundary markers: The templates do not explicitly define boundary markers or 'ignore' instructions for content processing.
- Capability inventory: The skill utilizes
Bash,Read,Write,Edit,Grep, andGlobtools across its lifecycle. - Sanitization: No specific sanitization or validation logic is documented for the eval artifacts.
- Assessment: While this represents a potential injection surface if an attacker controls the project files, the framework is designed for internal development use, making the risk profile consistent with standard development tooling.
Audit Metadata