kitaru-adapter-builder
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands, specifically Kitaru CLI tools and package managers (npm, pip). These are constrained by a mandatory "Explicit approval gate" policy defined in the SKILL.md, requiring the user to approve the exact command, package, and version before any action is taken.
- [EXTERNAL_DOWNLOADS]: The skill identifies and potentially proposes the installation of various Kitaru-related libraries (e.g., kitaru-pydantic-ai, @zenml-io/kitaru-mastra). These downloads are restricted to known vendor packages and require explicit user authorization for the specific version and command used for installation.
- [CREDENTIALS_UNSAFE]: The documentation mentions authentication tokens such as KITARU_API_TOKEN. However, the skill provides specific instructions to redact or omit authorization headers, API keys, and access tokens from all recorded sessions, logs, and reports, demonstrating a clear security-first approach to credential management.
- [INDIRECT_PROMPT_INJECTION]: As the skill processes user code and framework hooks to build adapters, it is technically exposed to indirect prompt injection from codebase content. The risk is minimized by the skill's instruction to use allowlisted field paths, bounded serialization depth, and strict boundary markers during implementation.
- [DATA_EXFILTRATION]: While the skill creates remote Kitaru sessions to store agent traces, this is the primary declared function of the tool. The exfiltration risk is mitigated by explicit approval gates for session creation, clear documentation of the data destination, and strict redaction policies for sensitive data fields.
Audit Metadata