The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent in references/execution-modes.md to execute shell commands such as npm run run -- "<refined prompt contract>" and bun run src/cli.ts run. Because the 'refined prompt contract' is generated from user-provided objectives, this creates a high risk of command injection. If the user provides a payload containing shell metacharacters (e.g., semicolons, backticks, or dollar signs) and the agent or the harness fails to sanitize them, it could lead to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: The skill relies on an external harness (Search Swarm+ or Kimi Code CLI) to perform research and coding tasks. This involves running local scripts that orchestrate complex multi-agent workflows, including external API calls and source collection. The reliance on executing local scripts that are essentially wrappers for remote interactions qualifies as a significant remote code execution surface.
[EXTERNAL_DOWNLOADS]: The README.md and references/upstream-prompt-engineering.md refer to the treylom/prompt-engineering-skills GitHub repository. The installation instructions guide users to clone this external repository and copy its content into the ~/.claude/skills directory. This pattern introduces unverified third-party code into the agent's execution environment without integrity checks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests a user's 'rough request' and interpolates it into a 'prompt contract' that governs sub-agents and tool calls.
Ingestion points: User requests are captured in SKILL.md for refinement.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the refined prompt from inheriting malicious instructions designed to hijack the sub-agent swarm or the search harness.
Capability inventory: The skill has the capability to write to the filesystem (e.g., ~/.kimi) and execute shell commands.
Sanitization: The instructions lack any mention of sanitizing or validating user input before it is transformed into an executable objective.

kimi-agent-swarm-prompt