The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the kitaru CLI tool and MCP operations for session management, imports, and evaluator registration.
Evidence includes instructions in references/kitaru-operations.md to run kitaru status, kitaru session import, and kitaru investigation create.
The skill includes safety guardrails requiring the agent to explain remote writes and obtain explicit user approval before executing commands that change the project environment.
[DYNAMIC_EXECUTION]: The skill provides a workflow for authoring custom Python evaluators, which includes generating and testing code locally.
references/evaluator-authoring.md describes implementing a Kitaru contract in Python and testing it using kitaru evaluator test PATH.
The instructions explicitly warn that the test command executes local code in a bounded child process rather than a security sandbox, advising the agent to review the code and use isolated environments.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted trace data from external sources, creating a potential surface for indirect prompt injection.
Ingestion points: The skill reads data from local JSONL files (e.g., traces/langfuse-traces.jsonl) and external provider APIs like Langfuse, LangSmith, and Braintrust.
Boundary markers: The skill includes explicit instructions in SKILL.md and references/starter-template.md to treat every trace payload and README file as untrusted input and to never treat prose inside a trace as an instruction.
Capability inventory: The agent has the ability to execute CLI commands and run Python code via the kitaru toolset.
Sanitization: The skill relies on an "evidence-led" human review process (Judge step) where a human validates the agent's observations and synthesizes behavior before it is used for automation or evaluators.

kitaru-investigation