hand-over-to-kiro
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the kiro-cli tool through a bundled helper script (helpers/run-kiro.sh) which enforces a least-privilege security model. Permissions are scoped based on the task (e.g., read-only for reviews) using the trust-tools flag.
- [PROMPT_INJECTION]: Comprehensive mitigations are implemented for indirect prompt injection risks. The agent is instructed to rephrase user inputs and use XML boundary tags to separate instructions from untrusted data. 1. Ingestion points: User requests and local workspace files. 2. Boundary markers: XML tags like and are used. 3. Capability inventory: Filesystem access (read/write) and shell execution via kiro-cli. 4. Sanitization: Rephrasing untrusted input and passing data via STDIN to avoid shell interpolation.
- [EXTERNAL_DOWNLOADS]: Provides links to official installation guides. The skill includes explicit guardrails that prohibit automatic tool installation or the execution of remote installer scripts, maintaining user control over the environment.
Audit Metadata