kyro-sprint-flow

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests structured and prose results from specialized subagents (Executor, QA) to maintain flow state and build Fix Plans for addressing issues.
  • Ingestion points: Worker results are stored in worker_results, executor_results, and qa_results as described in the "Flow State" section of SKILL.md.
  • Boundary markers: The skill relies on markdown headers (e.g., ## STATUS, ## WORK COMPLETED) to delimit worker data but does not explicitly warn subagents to ignore instructions embedded within those sections.
  • Capability inventory: The orchestrator has access to Bash, Read, Glob, and Grep tools, and it has the capability to launch and parameterize new subagents.
  • Sanitization: There is no mention of sanitizing or escaping the content provided by workers before it is interpolated into the briefs for subsequent workers.
  • [DYNAMIC_EXECUTION]: The skill dynamically assembles instruction "briefs" for subagents based on the current flow state and prior results.
  • Evidence: The "Worker Launch Pattern" and Steps 1-4 in SKILL.md detail how the orchestrator constructs prompts (briefs) containing prior results and state data to be executed by new subagents.
  • [COMMAND_EXECUTION]: The skill uses shell commands to check the status of the project environment.
  • Evidence: The Workflow Step 0 in SKILL.md specifies running kyro status via the Bash tool to identify the active sprint and stage.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 08:17 PM
Security Audit — agent-trust-hub — kyro-sprint-flow