kyro-sprint-flow
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests structured and prose results from specialized subagents (Executor, QA) to maintain flow state and build Fix Plans for addressing issues.
- Ingestion points: Worker results are stored in
worker_results,executor_results, andqa_resultsas described in the "Flow State" section of SKILL.md. - Boundary markers: The skill relies on markdown headers (e.g.,
## STATUS,## WORK COMPLETED) to delimit worker data but does not explicitly warn subagents to ignore instructions embedded within those sections. - Capability inventory: The orchestrator has access to
Bash,Read,Glob, andGreptools, and it has the capability to launch and parameterize new subagents. - Sanitization: There is no mention of sanitizing or escaping the content provided by workers before it is interpolated into the briefs for subsequent workers.
- [DYNAMIC_EXECUTION]: The skill dynamically assembles instruction "briefs" for subagents based on the current flow state and prior results.
- Evidence: The "Worker Launch Pattern" and Steps 1-4 in SKILL.md detail how the orchestrator constructs prompts (briefs) containing prior results and state data to be executed by new subagents.
- [COMMAND_EXECUTION]: The skill uses shell commands to check the status of the project environment.
- Evidence: The Workflow Step 0 in SKILL.md specifies running
kyro statusvia theBashtool to identify the active sprint and stage.
Audit Metadata