kimu-case-bank
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local Python scripts (scripts/search_case_bank.py and scripts/validate_case_bank.py) to search, retrieve, and validate case data from both public and private storage layers.\n- [DATA_EXFILTRATION]: The skill is designed to read from ~/.kimu/case-bank/, a hidden directory in the user's home folder. This access is intended for local private data management but involves reading potentially sensitive information from the filesystem.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes case records from external markdown files which can contain untrusted content.\n
- Ingestion points: Data is loaded from references/cases.md and ~/.kimu/case-bank/cases.md via the search script.\n
- Boundary markers: The skill uses a structured schema with fields like 'Core Facts' and 'Evidence Status' to organize data, but it does not have hard technical boundaries to prevent the LLM from following instructions if they are embedded within these fields.\n
- Capability inventory: The skill can execute Python scripts to read file content and display it to the user or use it in further prompts.\n
- Sanitization: There is no evidence of content sanitization or escaping to prevent embedded instructions in the case files from influencing the agent's behavior.
Audit Metadata