The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs curl and jq for interacting with the Moonshot API, including fetching model lists and sending chat completions. These commands are static and used for legitimate integration purposes.
[EXTERNAL_DOWNLOADS]: Network operations are directed towards official Kimi API endpoints (api.moonshot.ai) for model verification and inference. These connections are necessary for the skill's functionality and target a well-known service provider.
[INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of processing external data and provides mitigation strategies:
Ingestion points: User prompts and external log files (e.g., incident.txt) are identified as data sources in api-patterns.md.
Boundary markers: safety-workflows.md outlines a 'Safe-Send Checklist' and user approval boundaries to be stored in approvals.md.
Capability inventory: Subprocess calls include curl for network access and sed for text manipulation.
Sanitization: The skill includes a dedicated redaction pass using sed to filter out secrets and identifiers before transmission.

Kimi