kiro-impl

SUSPICIOUS. The skill’s capabilities mostly match its stated purpose as an autonomous implementation controller, and there is no evidence of credential theft, hidden exfiltration, or malicious installers. Risk comes from autonomous repo-driven command execution, optional external web research combined with write/exec powers, and third-party/community provenance without strong first-party release assurances.