CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/model-risk-evidence-matrix

Assigns an ML model to a low, medium, or high risk tier from what its predictions decide about people, then derives the fairness and explainability evidence that tier must produce: group metrics per declared sensitive feature, intersectional breakdowns with per-cell counts, vulnerability scan categories, a drift monitoring plan, and per-prediction explanation logs. Supplies conventional demographic parity difference bands, a per-vulnerability-category blocking table, evidence rules marking a bundle incomplete or self-contradicting, and a fairness gating workflow that walks a candidate's model card + evidence bundle to a promote / needs-work / block verdict with refuse rules; a reference covers producing the explanation records with Alibi Explain. Use when a model release candidate is up for promotion and someone must decide which fairness artifacts are mandatory, when a declared risk tier's evidence bundle must be checked against what the tier demands, or when the evidence review must gate the promotion.

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Low

Low-risk findings.

1 low severity finding. Worth noting, but not necessarily harmful.

Low

W011: Third-party content exposure detected (indirect prompt injection risk).

What this means

The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.

Why it was flagged

SKILL.md’s Step 9 fairness-gating workflow ingests a release candidate’s model card and evidence bundle (including sensitive-feature lists, fairness metrics/DPD values, drift monitoring claims, vulnerability scan JSON, and per-prediction explanation logs) that a provider user authors, so outsider free text/JSON fields are directly read and evaluated at runtime.

Where we found it

user-provided model card + evidence bundle (model_card.json, fairness numbers, vulnerability scan JSON, drift monitoring plan, explanation logs)

content-type · 11 sites

Step 9 instructs the agent to read and evaluate a release candidate's model card and evidence bundle provided by the user as local files; no external fetching occurs, but the model provider could be a different organizational party from the reviewer.

Report incorrect finding
Audited
Security analysis
Snyk