nopua
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains specific defensive instructions for agents to treat external inputs as data rather than commands, which is a best practice for mitigating indirect prompt injection.
- [CREDENTIALS_UNSAFE]: No sensitive credentials or data exfiltration patterns were detected. A placeholder API key (
sk-guwen-default-key-2024) in the benchmark project configuration is used for local demonstration purposes and does not represent a security risk. - [COMMAND_EXECUTION]: The Python scripts are legitimate tools for code analysis and model benchmarking. Manual review of the code confirmed that a flagged '.eval()' call in the training module is a standard PyTorch function used for switching model behavior to evaluation mode, not the unsafe Python built-in function.
- [EXTERNAL_DOWNLOADS]: The skill documentation references its own repository on GitHub for installation and fetches configuration for benchmarking from established AI service providers like Anthropic, OpenAI, and Google, which are well-known and trusted sources.
Audit Metadata