nemo-evaluator

Hardcoded credentials detected. Passwords, API keys, and secrets should not be hardcoded in source code. Use environment variables or a secrets manager instead.

api_key="nvapi-your-key-here"

The Python API example demonstrates passing API keys as plaintext strings in code, which risks accidental commit to version control systems.

api_key="nvapi-your-key-here"

The configuration system allows passing arbitrary environment variables and execution parameters to the evaluation harness. An attacker could potentially inject malicious commands or environment variables into the evaluation process if they control the config file. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

env_vars:
        HF_TOKEN: HF_TOKEN

NER model detected organization in skill content (confidence: 0.52)

L*

NER model detected organization in skill content (confidence: 0.54)

N****

NER model detected organization in skill content (confidence: 0.57)

S********

NER model detected organization in skill content (confidence: 0.59)

D*****

NER model detected organization in skill content (confidence: 0.61)

E*********

NER model detected organization in skill content (confidence: 0.62)

M*******

NER model detected organization in skill content (confidence: 0.67)

M***

NER model detected organization in skill content (confidence: 0.69)

N******

NER model detected organization in skill content (confidence: 0.72)

S******

NER model detected organization in skill content (confidence: 0.75)

N*****

NER model detected organization in skill content (confidence: 0.81)

H********

NER model detected organization in skill content (confidence: 0.90)

O********

NER model detected organization in skill content (confidence: 0.97)

L*****

NER model detected organization in skill content (confidence: 0.57)

*

NER model detected organization in skill content (confidence: 0.79)

*

NER model detected organization in skill content (confidence: 0.81)

*

SKILL.md links to "references/adapter-system.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/adapter-system.md](references/adapter-system.md)

SKILL.md links to "references/configuration.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/configuration.md](references/configuration.md)

SKILL.md links to "references/custom-benchmarks.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/custom-benchmarks.md](references/custom-benchmarks.md)

SKILL.md links to "references/execution-backends.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/execution-backends.md](references/execution-backends.md)