The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill orchestrates a delegation flow to a sub-agent (Kimi Code) that lacks a read-only mode and operates with automatic permissions. This environment is susceptible to indirect prompt injection if the sub-agent processes malicious files in the workspace.
Ingestion points: SKILL.md and references/writing-the-brief.md describe how the implementer reads the task brief and inspects the repository workspace (e.g., services/billing/).
Boundary markers: The instructions recommend XML-based structure (<task>, <action_safety>) to define boundaries, though it notes the implementer has no CLI-enforced restrictions.
Capability inventory: The sub-agent has full write access to the working tree and capability to run shell commands as part of its implementation process.
Sanitization: The skill relies on post-execution human review and the re-running of project gates (tests, linting) rather than pre-execution input sanitization.
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands involving Node.js and the Kimi CLI binary. These commands interact with local file paths and environment configurations.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading the Kimi Code implementer via the Homebrew package manager (brew install kimi-code), which is a well-known service.

kimi-delegate