ClawHub

Evalpal

v1.0.1

Run AI agent evaluations via EvalPal — trigger eval runs, check results, and list available evaluations

⭐ 0· 66·1 current·1 all-time
by@matthewengman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description describe running EvalPal evaluations and the bundle contains three scripts that call EvalPal API endpoints. The declared required binary/tools (curl, jq) and required env var (EVALPAL_API_KEY) are appropriate for this purpose. The SKILL.md documents an optional EVALPAL_API_URL (defaults to https://evalpal.dev), which is reasonable.
✓
Instruction Scope
All instructions and included scripts consistently perform only API calls to the EvalPal service, poll for run status, and format results. The scripts do not read unrelated files, do not reference other environment secrets, and do not send data to external endpoints beyond the configured API_URL. They explicitly avoid printing the API key and use HTTPS.
✓
Install Mechanism
No install spec; this is instruction-only plus shell scripts. That is low-risk: nothing is downloaded or installed by the skill itself. The only runtime dependencies are standard system tools (curl, jq).
✓
Credentials
The skill requires a single API key (EVALPAL_API_KEY) which matches its stated need to authenticate to EvalPal. The optional EVALPAL_API_URL is documented but not required. No unrelated credentials or config paths are requested.
✓
Persistence & Privilege
The skill is not set to always:true and does not request persistent or cross-skill configuration changes. It can be invoked by the agent (normal default); that autonomous invocation is expected for skills but does not add unusual privileges here.
Assessment
This skill appears to do exactly what it says: call the EvalPal API to list evals, start runs, and fetch results. Before installing: ensure you trust the https://evalpal.dev service and create an API key with the least privileges needed; avoid supplying a high-privilege or long-lived key if possible. Confirm you are comfortable allowing your agent to call the API (agent invocation is allowed by default). If you override EVALPAL_API_URL, verify the custom domain is trusted. As a routine precaution, rotate the API key if you suspect exposure and review logs for unexpected activity. Finally, you can sanity-check the included scripts locally (they're plain shell) to confirm they meet your operational and security expectations.

Like a lobster shell, security has layers — review code before you run it.

evaluation testing quality ai-agentsvk977tr3phsjgwb8k144fv309vs83n1x1latestvk97f1fdm67a0ncyt5vetfnczw583mxqq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binscurl, jq
EnvEVALPAL_API_KEY

Comments