The Agent Skills Directory

[SAFE]: The skill consists of technical documentation and developer guidelines for a Terminal UI (TUI). It defines architectural boundaries and coding conventions without introducing executable code or dangerous instructions.
[DATA_EXPOSURE]: The skill mentions configuration persistence via saveTuiConfig and an authentication flow (auth-flow.ts). However, it explicitly states that UI components are restricted from direct file writes and must use designated persistence methods, which follows security best practices for least privilege.
[REMOTE_CODE_EXECUTION]: The skill references the @moonshot-ai/kimi-code-sdk for core functionality. This is a vendor-owned resource consistent with the skill's author context and is used for internal application logic rather than arbitrary remote code execution.
[COMMAND_EXECUTION]: The documentation describes the handling of slash commands and CLI arguments. These are standard features for the application's user interface and are processed through a structured coordinator (KimiTUI) rather than being passed directly to a shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill defines how transcript message types and tool-result displays are rendered. While this represents a surface for processing untrusted data, the architecture delegates handling to specific controllers and renderers, following standard UI patterns. The associated risk is low and inherent to the application's primary purpose.

write-tui