kitaru-replay-experiment
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing structured Kitaru CLI commands (e.g.,
kitaru experiment create,kitaru replay start) and SDK scripts. It involves the dynamic construction of shell commands with JSON arguments and environment variables likeKITARU_WORKER_CONCURRENCY=10andKITARU_ACTIVE_SKILL=kitaru-replay-experimentfor attribution. - [INDIRECT_PROMPT_INJECTION]: Replaying historical session data to evaluate agent candidates creates a surface for indirect prompt injection, as malicious instructions in those inputs could attempt to influence the evaluation or the agent's behavior. * Ingestion points: Historical session inputs and evaluator-version data retrieved via MCP tools
kitaru_registry_readandkitaru_activity_readas described in SKILL.md. * Boundary markers: The skill instructions focus on comparison methodology and rigor but do not define specific technical delimiters or sandbox markers for the replayed data within the task environment. * Capability inventory: The skill has the capability to create experiments, start asynchronous runs, and execute platform-specific CLI/SDK commands. * Sanitization: The manifest and references do not describe explicit sanitization or filtering protocols for the ingested historical session data.
Audit Metadata