The Agent Skills Directory

[COMMAND_EXECUTION]: The CLI interacts with the local environment by executing binaries such as git and bun. It mitigates shell injection risks by utilizing a shellQuote utility to escape paths and a slugify function to sanitize branch names and run identifiers.
[DATA_EXPOSURE]: The skill includes a proactive redaction system in scripts/lib/redact.ts. This module uses regular expressions to identify and strip common credential formats (e.g., Moonshot API keys, Bearer tokens, and generic key/token patterns) from user-provided task descriptions before they are written to implementation artifacts or prompt files.
[PROMPT_INJECTION]: The skill manages indirect prompt injection risks by enforcing a human-in-the-loop workflow. It processes untrusted task descriptions as input but requires agents to first generate a PLAN.md which must be reviewed by the user. It also uses explicit boundary markers in the generated KIMI_PROMPT.md to scope the sub-agent's instructions.
[SAFE]: Extensive filesystem safety checks are implemented, including resolveInside to prevent directory traversal and assertNonSymlinkAncestor to reject writes through malicious symbolic links. All state is maintained in isolated directories under XDG_STATE_HOME or project-local .agents folders with restricted file permissions (0o600).

kimi-ui-agent