krt-skill-arbiter

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/test_skill_arbiter.py utilizes subprocess.run to execute local validation utilities (check_corpus.py, score_run.py, check_portfolio.py). This is a standard testing mechanism and is implemented securely using argument lists to avoid shell-based vulnerabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted test prompts and evaluation results, which presents an indirect injection surface.
  • Ingestion points: references/cases.json, references/expectations.json, and result artifacts passed to scripts/score_run.py.
  • Boundary markers: The skill incorporates references/safety.md, which provides explicit instructions to treat all prompts, tool logs, and evaluation data as untrusted evidence rather than instructions.
  • Capability inventory: The skill can read local repository files (scripts/check_portfolio.py) and execute its own internal scripts via subprocess (scripts/test_skill_arbiter.py).
  • Sanitization: All external data is parsed via deterministic Python scripts using json.loads and validated against strict schemas before processing, preventing the model from directly executing the data content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 08:55 AM
Security Audit — agent-trust-hub — krt-skill-arbiter