The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of custom evaluators through the kitaru evaluator test and kitaru evaluator register commands. As explicitly stated in references/evaluator-authoring.md, the testing process executes local code in a bounded child process without a security sandbox. This presents a risk where the agent or an attacker could execute arbitrary code on the host system by providing a malicious evaluator script.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external trace data (e.g., langfuse-traces.jsonl). references/starter-template.md acknowledges this attack surface, instructing the agent to treat README files and trace payloads as untrusted input to avoid executing embedded instructions. However, the capability to read these files and then perform actions (like creating investigations or annotations) based on their content maintains a susceptibility to indirect injection.
[COMMAND_EXECUTION]: The skill makes extensive use of the kitaru CLI to manage resources, import data, and status the environment. While these are core functionalities, the reliance on shell-level execution for operations like kitaru session import and kitaru evaluator test creates a wide surface for potential command injection if parameters are not strictly validated.

kitaru-investigation