The Agent Skills Directory

[COMMAND_EXECUTION]: The skill discovers and executes build, test, and smoke-test commands defined within repository files such as package.json, Makefile, and CI configurations. This allows for the execution of arbitrary shell commands found in the analyzed project codebase.
[DATA_EXFILTRATION]: The debugger-prompt.md template instructs sub-agents to search the web using exact error messages and symptoms. This behavior can lead to the exfiltration of sensitive information if credentials, environment variables, or proprietary logic are present in runtime error outputs or stack traces.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external repository files (tasks.md, spec.json, requirements.md) to construct instructions for sub-agents.
Ingestion points: Context loading in SKILL.md and template interpolation in implementer-prompt.md and reviewer-prompt.md.
Boundary markers: The skill uses Markdown headers and structured code blocks as delimiters in sub-agent prompts.
Capability inventory: Spawning sub-agents, shell command execution, and web search access.
Sanitization: No explicit sanitization or escaping of the content from spec files is performed before inclusion in sub-agent prompts.
[SAFE]: The workflow incorporates defensive measures via the kiro-review protocol, which performs automated scans for hardcoded secrets (e.g., api_key=, token=) and ensures that code changes remain within defined task boundaries.

kiro-impl