phoenix-evals
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official software development kits (SDKs) and dependencies through standard package managers. \n
- Evidence: Installation commands for
arize-phoenixpackages and provider SDKs (OpenAI, Anthropic, Google) inreferences/setup-python.mdandreferences/setup-typescript.md. \n - Sources: All downloads target official registries (PyPI, NPM) and are associated with well-known technology vendors or the skill's authoring organization (Arize AI). \n- [INDIRECT_PROMPT_INJECTION]: The skill documents the creation of evaluators that process untrusted external data (such as user queries and LLM outputs), creating a potential surface for indirect prompt injection. \n
- Ingestion points: Production traces, datasets, and dataframes as described in
references/production-continuous.mdandreferences/experiments-datasets-python.md. \n - Boundary markers: The skill explicitly recommends and demonstrates the use of XML tags (e.g.,
<context>,<question>,<response>) to separate untrusted data from instructions in prompt templates, as shown inreferences/evaluators-custom-templates.md. \n - Capability inventory: The evaluators call external LLM models to perform classification and reasoning tasks (
references/evaluators-llm-python.md). \n - Sanitization: No specific sanitization logic is provided beyond the implementation of structural delimiters (XML tags).
Audit Metadata