The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly mandate the concealment of technical actions from the user interface.
In SKILL.md, the agent is instructed to "Keep routine setup, file searches, command syntax, process details, and retries out of user-facing messages" and to "Perform routine reads and recoverable command corrections silently."
While intended to simplify the user experience during a guided tour, these instructions actively reduce transparency regarding the agent's low-level system interactions.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes Python code at runtime to create custom evaluators.
According to references/kitaru-operations.md, the skill uses the writeOnboardingEvaluator tool to write Python source code to a local path (.kitaru-onboarding/evaluators/evaluator.py).
The agent then executes this generated script using kitaru evaluator test for verification before registering the evaluator remotely.
[INDIRECT_PROMPT_INJECTION]: The skill processes external conversational data, creating a surface for potential indirect prompt injection attacks.
Ingestion points: The skill imports recorded traces from external files such as traces/langfuse-traces.jsonl (referenced in SKILL.md).
Boundary markers: The instructions do not define explicit boundary markers or include warnings to ignore instructions that might be embedded within the processed trace data.
Capability inventory: The agent possesses capabilities for shell command execution (runOnboardingCommand) and local file creation (writeOnboardingEvaluator).
Sanitization: There is no evidence of content sanitization or validation for the trace data before it is presented to the user or used to define evaluators.

kitaru-hosted-onboarding-tour