kiro-debug
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from repository files and web search results to generate implementation plans.
- Ingestion points: Reads repository configuration files (
package.json,pyproject.toml,go.mod,Makefile), local documentation (README*,requirements.md,design.md), and results from web searches. - Boundary markers: The instructions do not include markers or delimiters to differentiate between the agent's instructions and the untrusted content being analyzed.
- Capability inventory: The skill is designed to produce a
FIX_PLANandVERIFICATIONcommands, providing a path for injected instructions to influence system state if malicious content is present in the ingested data. - Sanitization: No sanitization or validation logic is specified for the data gathered from the repository or external documentation sources.
- [COMMAND_EXECUTION]: The instructions direct the agent to propose verification commands to confirm root-cause fixes. These are intended for debugging purposes and are consistent with the skill's primary function.
Audit Metadata