The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains explicit instructions to bypass tool security and authorization prompts in the Kiro CLI environment. In both references/autonomous-mode.md and references/parallel-mode.md, it directs the user to run /tools trust-all or /tools trust read write shell. This removes safety constraints and allows the agent to execute arbitrary shell commands and file operations without user confirmation.
[EXTERNAL_DOWNLOADS]: The skill automates the installation of third-party dependencies using shell commands (e.g., npm install, pip install) with non-interactive flags like -y, --yes, and --non-interactive as seen in references/autonomous-mode.md. Combined with the instruction to disable security prompts, this facilitates the silent introduction of external code into the local environment.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon data from untrusted external sources.
Ingestion points: Reads implementation tasks from tasks.md, architecture specs from design.md, and documentation via web search (actions/standard-mode.md).
Boundary markers: While it uses process-based instructions (e.g., "Follow design documents precisely"), it lacks technical delimiters or sanitization logic to prevent malicious instructions embedded in these documents from influencing agent behavior.
Capability inventory: The agent has the ability to write to the file system, execute shell commands, and dispatch sub-agents (invokeSubAgent, Agent).
Sanitization: No validation or filtering is performed on the content of design documents or external resources before they are used to guide code generation and execution.

aidlc-implement