arize-evaluator

Warn

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The skill provides instructions to modify user shell profile files (e.g., ~/.zshrc, ~/.bashrc) to persist the ARIZE_SPACE environment variable across sessions. While used for configuration, this technique qualifies as a persistence mechanism.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the ax CLI tool to perform operations such as managing AI integrations, evaluators, and tasks. It also uses python3 to process command outputs.
  • [DYNAMIC_EXECUTION]: The skill uses python3 -c to execute embedded script strings at runtime for the purpose of parsing and formatting JSON data retrieved from the Arize platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill builds and executes LLM-as-judge templates that process untrusted external data, which could potentially influence the judge model's output.
  • Ingestion points: External data is ingested from Arize via the ax spans export and ax experiments export commands (SKILL.md).
  • Boundary markers: The skill uses template instructions for the judge model, such as 'Respond with exactly one of these labels: hallucinated, factual', to constrain the output.
  • Capability inventory: The skill has capabilities to create, update, and trigger evaluation tasks via the ax CLI, affecting resources within the Arize space.
  • Sanitization: The skill recommends the use of generic, portable variable names and binary classification labels to improve consistency and reduce the impact of malformed inputs.
  • [EXTERNAL_DOWNLOADS]: The skill documents the installation of the arize-ax-cli package from official registries using package managers like uv, pipx, or pip.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 15, 2026, 07:50 AM
Security Audit — agent-trust-hub — arize-evaluator