krt-skill-arbiter
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/test_skill_arbiter.pyutilizessubprocess.runto execute local validation utilities (check_corpus.py,score_run.py,check_portfolio.py). This is a standard testing mechanism and is implemented securely using argument lists to avoid shell-based vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted test prompts and evaluation results, which presents an indirect injection surface.
- Ingestion points:
references/cases.json,references/expectations.json, and result artifacts passed toscripts/score_run.py. - Boundary markers: The skill incorporates
references/safety.md, which provides explicit instructions to treat all prompts, tool logs, and evaluation data as untrusted evidence rather than instructions. - Capability inventory: The skill can read local repository files (
scripts/check_portfolio.py) and execute its own internal scripts via subprocess (scripts/test_skill_arbiter.py). - Sanitization: All external data is parsed via deterministic Python scripts using
json.loadsand validated against strict schemas before processing, preventing the model from directly executing the data content.
Audit Metadata