agentv

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill facilitates the execution of arbitrary scripts through the code-grader assertion type and execution hooks such as before_all and after_all. These allow users to run Python, Node.js, or shell scripts during the evaluation process to programmatically validate agent outputs.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on EVAL.yaml files which ingest untrusted test inputs and rubrics. These are interpolated into prompts for target agents and LLM-based graders using template variables like {{answer}} and {{input}}. While intended for evaluation, this mechanism presents a surface for instructions embedded in test data to influence agent behavior.
  • [EXTERNAL_DOWNLOADS]: The documentation instructs users to install the agentv CLI globally using npm install -g agentv. This introduces a dependency on external code from the npm registry, though it is the primary tool for which the skill is designed.
  • [COMMAND_EXECUTION]: The skill's core workflow relies on the execution of shell commands via the agentv CLI. It documents commands for initializing projects, running evaluations with specific targets, and comparing result sets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 04:50 AM