llm-evaluation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited llm-evaluation (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
If you cannot measure it, you are tuning prompts in the dark. Build the eval before you tune.
Skip formal evals only for throwaway scripts. Anything that ships gets at least a small fixed set.
A golden set is a fixed collection of (input, expected) pairs that defines "correct" for your task.
eval/v2).expected should be defensible; ambiguous labels poison every metric.Leakage = your eval secretly rewards memorization or itself, inflating scores.
| Metric | Use for | How |
|---|---|---|
| Exact / normalized match | Classification, extraction, enums | Compare after normalizing case/whitespace |
| Field-level / JSON match | Structured output | Compare per key; report which fields fail |
| Rubric (LLM-as-judge) | Open-ended generation, summaries | Score against an explicit rubric, 1–5 |
| pass@k | Code / tasks with a verifier | Sample k; pass if any sample passes the check |
| Task success | Agents / tool use | Did it reach the goal state? (programmatic check) |
| Regression rate | Any fixed set | % of previously-passing cases now failing |
Prefer a programmatic check (exact match, schema validation, unit test) whenever the task allows — it is cheap, deterministic, and leak-proof. Reserve LLM-as-judge for genuinely open-ended output.
{"score": 1-5, "reason": "..."}) and log the reason.| Offline | Online | |
|---|---|---|
| Runs on | Fixed golden set, in CI | Real production traffic |
| Answers | "Did this change regress anything?" | "Does it work for real users?" |
| Signals | Pass rate, regression count | A/B metrics, thumbs up/down, task completion |
| Speed | Fast, deterministic, pre-merge | Slow, noisy, post-deploy |
Use both: offline to gate merges, online to validate real-world impact. Online comparisons track with-feature vs baseline (control), not feature-vs-nothing.
1. Write/extend the golden set for the behavior you want.
2. Run the current prompt → record baseline score.
3. Change ONE thing (prompt, model, params).
4. Re-run the SAME set → compare to baseline.
5. Keep the change only if it wins overall AND regresses nothing critical.
6. Add any new failure you found as a permanent case. Go to 1.Change one variable at a time, or you cannot attribute the delta.
# golden set: fixed (input, expected) pairs
cases = [
{"input": "App crashes on PDF export", "expected": "bug"},
{"input": "How do I change billing email?", "expected": "how_to"},
{"input": "", "expected": "other"}, # null case
]
def run(model_fn, prompt_version):
results = []
for c in cases:
got = model_fn(c["input"]) # the LLM feature under test
ok = got.strip().lower() == c["expected"] # exact-match metric
results.append({"input": c["input"], "got": got,
"expected": c["expected"], "pass": ok})
score = sum(r["pass"] for r in results) / len(results)
return score, results
base_score, _ = run(triage_v2, "v2") # baseline
new_score, fails = run(triage_v3, "v3") # candidate
print(f"v2={base_score:.2%} v3={new_score:.2%} delta={new_score-base_score:+.2%}")
regressions = [r for r in fails if not r["pass"]] # inspect what broke
assert new_score >= base_score, "v3 regressed — do not ship"The shape is always the same: inputs → run → score → compare. Swap the scorer (schema check, pass@k, judge) per task; keep the loop.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.