Environment Variables

View as Markdown

Every environment variable SkillEvaluator reads, grouped by feature area. Each group links to the guide that explains the workflow the variables belong to — this page is the inventory, not the tutorial.

Boolean variables accept 1, true, yes, or on (case-insensitive) as true, and 0, false, no, or off as false.

Two historical SkillEvaluator prefixes coexist. SKILL_EVAL_* covers provider and model configuration plus a small set of Tier 3 engine knobs; SKILLEVALUATOR_* covers product-level validation, report paths, scanner paths, and sandbox/runtime behavior. The prefixes are part of each variable’s literal public name and are not interchangeable. The separately documented SKILLSPECTOR_* family belongs to SkillSpector, provider credential families belong to their providers, and Harbor, the open-source agent evaluation framework used for Tier 3, owns the HARBOR_* in-container grader contract. None belongs to either SkillEvaluator prefix.

LLM provider

These variables select and configure the provider used for LLM-backed checks and judging. The setup walkthrough, including per-provider export blocks and default models, is in Providers & Credentials.

VariableDefaultEffect
SKILL_EVAL_LLM_PROVIDERauto-selected (see below)Provider for chat and judging: openai, anthropic, nv_build, bedrock, or openai-compatible.
SKILL_EVAL_LLM_MODELprovider defaultChat model override. Required for openai-compatible — that provider has no default. Setting it to an empty string is a configuration error.
SKILL_EVAL_LLM_BASE_URLprovider default endpointEndpoint override; takes precedence over OPENAI_BASE_URL and ANTHROPIC_BASE_URL. Required for openai-compatible. Ignored by nv_build, whose endpoint is fixed to https://integrate.api.nvidia.com/v1 — point a custom endpoint at the openai-compatible provider instead.
SKILL_EVAL_LLM_API_KEYAPI key for the openai-compatible provider (local servers still require it to be set).
NVIDIA_API_KEYCredential for the nv_build provider (NVIDIA Build).
OPENAI_API_KEYCredential for the openai provider.
ANTHROPIC_API_KEYCredential for the anthropic provider.
OPENAI_BASE_URLhttps://api.openai.com/v1Alternate OpenAI endpoint; SKILL_EVAL_LLM_BASE_URL wins when both are set.
ANTHROPIC_BASE_URLAnthropic SDK defaultAlternate Anthropic endpoint; SKILL_EVAL_LLM_BASE_URL wins when both are set.
AWS_REGIONus-west-2Region for the bedrock provider.
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_PROFILE, …Standard AWS credential chain, used as-is by the bedrock provider.

Auto-selection

When SKILL_EVAL_LLM_PROVIDER is unset, auto-selection only happens when exactly one public credential is exported:

  • NVIDIA_API_KEYnv_build
  • OPENAI_API_KEYopenai
  • ANTHROPIC_API_KEYanthropic

If none is set, LLM-backed commands fail with a configuration error. If more than one is set, that is also a configuration error — there is no silent preference order, so set SKILL_EVAL_LLM_PROVIDER explicitly when multiple keys are exported.

SkillSpector bridge

The --llm security analysis runs SkillSpector, which has its own provider environment. SkillEvaluator bridges your configured provider into that invocation with an isolated subprocess environment: only the selected provider’s settings and a small set of basic process variables are forwarded, so ambient credentials for other providers never reach SkillSpector. The nv_build provider is bridged through SkillSpector’s OpenAI-compatible path, pointing OPENAI_BASE_URL at the public NVIDIA Build endpoint.

VariableDefaultEffect
SKILLSPECTOR_PROVIDERbridged from your providerOverrides the provider SkillSpector uses. Must name a supported public provider (openai, anthropic, bedrock, or nv_build) — only that provider’s credential variables are forwarded. Any other value fails closed: SkillSpector runs without a credential.
SKILLSPECTOR_MODELbridged from your configured modelModel SkillSpector uses for its LLM analysis.

Embeddings

Tier 2 semantic checks use an OpenAI-compatible embeddings API. Workflow context lives in Providers & Credentials and Tier 2: Deduplication.

VariableDefaultEffect
SKILL_EVAL_EMBEDDING_PROVIDERfalls back to SKILL_EVAL_LLM_PROVIDEREmbedding provider: openai, nv_build, or openai-compatible. anthropic and bedrock are rejected — they provide no embeddings API.
SKILL_EVAL_EMBEDDING_MODELprovider defaultEmbedding model override. Required for openai-compatible.
SKILL_EVAL_EMBEDDING_BASE_URLprovider default endpointEmbedding endpoint override; for openai-compatible it falls back to SKILL_EVAL_LLM_BASE_URL. Ignored by nv_build, whose endpoint is fixed to https://integrate.api.nvidia.com/v1 — use openai-compatible for a custom endpoint.
SKILL_EVAL_EMBEDDING_API_KEYfalls back to SKILL_EVAL_LLM_API_KEYAPI key for openai-compatible embeddings. openai and nv_build use their own provider keys.

Validation (Tier 1)

These variables tune the static and security checks. The check-by-check guide is Tier 1: Validation.

VariableDefaultEffect
SKILLEVALUATOR_PROFILEexternalDefault validation profile when no --profile flag is passed. The CLI flag always wins.
SKILLEVALUATOR_BANDIT_PATHauto-discoveredAbsolute path to the Bandit executable.
SKILLEVALUATOR_SEMGREP_PATHauto-discoveredAbsolute path to the Semgrep executable.
SKILLEVALUATOR_SKILLSPECTOR_PATHauto-discoveredAbsolute path to the SkillSpector executable.
SKILLEVALUATOR_SCHEMA_ALLOWED_DIRSExtra allowed skill-root directory names (comma- or whitespace-separated), e.g. data,fixtures. Additive only — names extend the built-in allowlist and never replace it.
SKILLEVALUATOR_SUBMITTERauto-detectedExplicit submitter identity for the home-path PII check. It is combined with GITHUB_ACTOR, USER, LOGNAME, USERNAME, the OS login name, and the skill’s declared author — every identity that resolves is protected. If none resolves, the home-path check is disabled with a warning.
SKILLEVALUATOR_PREVIOUS_VERSIONThe previously published skill version that the opt-in version check (--checks version) compares against.

The scanner path overrides fail closed: a value that is not an absolute, executable file is treated as a configuration error rather than silently falling back to another same-named binary on PATH. This prevents a planted executable from hijacking a security scan.

Live evaluation (Tier 3)

These variables control where results land and how Harbor confines local mode. The run workflow is Tier 3: Live Evaluation; execution environments are covered in Agents & Sandboxes.

VariableDefaultEffect
SKILLEVALUATOR_RESULTS_DIR<skill>/evals/resultsExternal root for run results. Precedence for writes: the --results-dir flag, then this variable, then the legacy in-skill location. Read commands (view, compare) honor the same order and also fall back to the legacy location so older runs stay visible.
SKILLEVALUATOR_LOCAL_SANDBOXrequireLocal-mode sandbox policy. require fails closed when no OS sandbox backend (Bubblewrap on Linux, Seatbelt on macOS) is usable; prefer degrades to advisory-only guardrails with a loud warning; off skips sandbox probing entirely — for skills you fully trust. No value enables native Windows: local mode fails closed there before anything runs — use WSL2 or --env-mode docker.
SKILLEVALUATOR_LOCAL_ALLOW_NETtrueNetwork egress for local-mode trials. Set to 0 to airgap a skill that must not reach the network. Incompatible with the nv_build provider — NVIDIA Build local agents require network access, so airgapped runs are rejected up front.
SKILLEVALUATOR_LOCAL_STRICT_READSfalseTightens the sandbox’s read-only view of the host system to a stricter path set.
SKILLEVALUATOR_LOCAL_INHERIT_AGENT_KEYSfalseWhen true, local-mode trials inherit the host’s agent credential variables into their ambient environment. Off by default so a hostile skill command cannot read credentials — agents and verifiers receive credentials per-exec instead.
SKILLEVALUATOR_RUNTIME_DIR~/.local/share/skillevaluator/runtimesWhere local mode looks for managed agent CLIs. Must be a dedicated subdirectory — not the home directory or one of its parents.
SKILL_EVAL_HARBOR_PREBUILD_TASK_ENVSunsetSet to exactly 1 to opt in to pre-building Harbor task environment images before trials start (other truthy spellings are not honored). Opt-in because concurrent trial cleanup can remove a shared prebuilt image that sibling trials still need.
SKILL_EVAL_JUDGE_MODELfalls back to SKILL_EVAL_LLM_MODELModel override for the Tier 3 dimension judge in standard grading. LLM_JUDGE_MODEL is honored as a higher-precedence spelling; when neither is set, the judge uses SKILL_EVAL_LLM_MODEL, then the built-in judge default.
SKILLEVALUATOR_HARBOR_DIAGNOSTIC_ARTIFACT_MAX_BYTES5242880 (5 MiB)Size cap per diagnostic artifact copied from a Harbor trial into the results directory; oversized artifacts are skipped and recorded in the artifact manifest.

In-container grader contract

The HARBOR_* variables are read by your custom grader inside the task container — you never set them yourself, and each has a fixed in-container default. The full reward contract, with defaults and examples, lives in Custom Graders & Tasks.

VariableWhat it carries
HARBOR_REWARD_JSONPath where your grader writes its reward.json score.
HARBOR_REWARD_TXTPath for the compatibility reward.txt dual-write.
HARBOR_ENTRY_JSONPath to the eval case entry being graded.
HARBOR_ATIF_PATHPath to the agent trajectory to grade, serialized in Agent Trajectory Interchange Format (ATIF).
HARBOR_LOGS_DIRRoot of the in-container log tree; the agent trajectory lives under its agent/ subdirectory.
HARBOR_TESTS_DIRDirectory holding the staged grader and test assets.
HARBOR_GRADERPath to the staged grader.py.

Set at runtime, not committed

Keep credentials out of skill repositories and CI configuration files. Export provider keys as masked secrets at runtime. Agent credentials for Tier 3 come only from the host environment — evals/config.yml runtime_env carries non-credential values, and any entry that names or references an operator-owned credential (OPENAI_API_KEY, ANTHROPIC_API_KEY, NVIDIA_API_KEY, their base-URL variables, CLAUDE_CODE_USE_BEDROCK, and the AWS_* credential variables) is rejected at run time, as are names that control the host process (PATH, DOCKER_*, proxy variables, SKILLEVALUATOR_*, and similar). See the blocked-names table in Providers & Credentials. With NVIDIA Build, one exported NVIDIA_API_KEY covers both the evaluator and the agents in the docker and local env-modes.

See also