The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill scaffolds and activates new AI agents by programmatically writing JSON configuration files to the system's agent directory ('.kiro/agents/'). These configurations define system prompts, tool permissions, and resource access levels, representing a significant runtime logic generation and dynamic loading surface.
[INDIRECT_PROMPT_INJECTION]: The orchestrator pattern ingests untrusted content from user-provided goals and iterative feedback. This data is passed into the execution loop and used to prompt sub-agents without explicit sanitization or boundary markers, creating an opportunity for embedded malicious instructions to influence sub-agent behavior across multiple steps.
Ingestion points: 'goal.md', 'context/prev-eval.md', and 'history/' directories (SKILL.md).
Boundary markers: Absent; prompts direct sub-agents to read files directly without delimiters.
Capability inventory: 'subagent' tool (spawning new agents), 'shell' tool (system commands), and 'fs_write' (file modification) (SKILL.md, references/agent-schema.md).
Sanitization: Absent; the skill relies on the LLM to follow instructions but provides no technical filtering of user input.
[COMMAND_EXECUTION]: The framework grants the orchestrator agent access to the 'shell' tool to manage directory structures and task life cycles. Although the skill template includes a 'deniedCommands' list (restricting 'rm'), the underlying capability allows for broader system interaction and potential command injection if the orchestrator is misled by a malicious task goal.

agent-harness