kitaru-guided-tour
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the 'kitaru' CLI and 'uv run' to manage the environment, register agents, import traces, and execute experiments. These operations are conducted within the project-local environment.
- [EXTERNAL_DOWNLOADS]: The skill clones a 'public Kitaru returns-agent template' and installs a frozen environment from a remote repository. This involves fetching and executing code from external sources, which is the primary mechanism for setting up the guided tour.
- [DYNAMIC_EXECUTION]: The skill generates and registers Kitaru evaluators at runtime based on human verdicts and observations. These evaluators are executable scripts designed to automate the checking of agent behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting trace data from 'traces/langfuse-traces.jsonl'. This untrusted content is processed by the agent to create observations, investigation questions, and reusable evaluators.
- Ingestion points: The skill reads session traces from a JSONL file located in the cloned template directory (SKILL.md, starter-template.md).
- Boundary markers: No specific delimiters or safety warnings for the trace payloads are documented in the instructions.
- Capability inventory: The agent can execute CLI commands, register scripts, and perform network operations through the Kitaru platform.
- Sanitization: There are no explicit instructions for sanitizing or escaping the content of the traces before processing.
Audit Metadata