Kimi DelegateSAFE

Delegate a coding task to a separate coding agent CLI, review the diff, land the commit yourself — one per implementer.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: kimi-delegate
description: >-
  Delegate a coding task to the Kimi Code CLI (`kimi`) as a background implementer, then review its
  diff and land it yourself. Use this whenever the user wants to hand implementation work to Kimi -
  phrasings like "have Kimi implement X", "delegate this to Kimi", "run it through Kimi Code", or
  "use Kimi to implement/fix/refactor" - or wants to run a queue of coding tasks through Kimi while
  staying the reviewer. DO NOT USE for tasks small enough to do inline, or when the user wants the code
  written directly without delegating.
license: MIT
metadata:
  version: 0.5.0
---

# Kimi Delegate

You are the **orchestrator**. Hand a bounded coding task to a separate **implementer** - the Kimi Code
CLI - then review what it produced and land it yourself. You write the brief and own the judgment;
Kimi does the typing in its own session; you verify and commit.

The loop needs only a shell command and file access, so any comparable orchestrator can drive it.

## When NOT to use this

- The task is small enough to do inline; delegation overhead is not worth it.
- The `kimi` CLI is not installed or authenticated.
- You need a CLI-enforced read-only implementer. Headless Kimi has no read-only mode.

## Prerequisites (check once)

1. Install Kimi Code with `brew install kimi-code` on macOS/Linux, or use the native installer from
   the [official Kimi Code documentation](https://moonshotai.github.io/kimi-code/en/).
2. Authenticate with `kimi login` (device-code flow, no TUI), or use `/login` in the TUI.
3. Confirm `kimi --version` succeeds.
4. Work in, or point `--cd` at, the target git repository.

## Choose the model alias

Kimi uses `default_model` from its `config.toml` when `--model` is omitted. To choose another model
alias, pass `--model <alias from your kimi config>`. Model aliases are user-defined config keys; use
one the human has configured rather than inventing one.

## The loop

Run these five steps per task. Steps 1, 4, and 5 require judgment; 2 and 3 are mechanical.

### 1. Write the brief

Kimi sees only the text you send plus what it can inspect in the workspace - no chat history or shared
context. Include the goal, current state, what to change, what to leave untouched, the project's
**actual** gates, and a report contract. Tell Kimi not to commit. Keep one task per brief. See
[references/writing-the-brief.md](references/writing-the-brief.md).

### 2. Dispatch

For **Codex orchestration of background work**, install and configure the separate
**codex-background** support utility first. If its MCP tools or registry are missing, stop and
report the setup requirement; do not silently fall back to model-driven polling. Then invoke its
registered `delegate_run` MCP tool once in place of the shell example below.
Follow that skill for structured common arguments, unchanged provider flags and reattachment by
runId. Keep the request pending until completion, then continue this skill's review and landing
steps. Other orchestrators keep the shell workflow below.

Use the bundled helper. It wraps Kimi's headless prompt mode, captures the structured event stream,
and writes `result.json`. (`<skill-dir>` is the installed folder containing this `SKILL.md`.)

```bash
node "<skill-dir>/scripts/relay.mjs" --brief brief.txt --cd /path/to/repo
# choose a configured model alias:       add --model <alias from your kimi config>
# resume the most recent session:        add --resume-last  (delta brief only)
# resume a specific session:             add --session <id> (delta brief only)
# hard time limit (watchdog):            add --timeout 2h  (the 30m default suits short runs; implementation briefs routinely need 1-2h)
# see all options:                       node .../relay.mjs --help
```

The child process's cwd pins the workspace. Use repeatable `--add-dir` flags only for extra workspace
directories. The relay writes artifacts under the system temp dir by default and never commits. See
[references/dispatch-and-poll.md](references/dispatch-and-poll.md).

### 3. Wait for completion

Codex using codex-background keeps the original MCP request pending: no model-driven sleep,
status or log polling. Use `delegate_wait` only to reattach after an interrupted request.

The helper blocks until Kimi finishes. Run it with the orchestrator's background-command facility, or
background it in the shell and poll for `result.json`. A pre-run usage error exits 2 and writes no
result; a missing `kimi` exits 127 and writes `status: "kimi_unavailable"`.

Trust process state and the working tree over a progress display. Completion means the process exited
and `result.json` exists. Kimi's full report is the `finalMessage` field in `result.json` (also printed
in full on stdout between the report markers).

### 4. Review - do not trust the self-report

Treat Kimi's final message and gate claims as claims:

- Re-run the project's gates yourself.
- Read the diff against the brief, starting with `touchedFiles`.
- Run relevant guard skills if installed.
- Round-trip migrations and grep for dangling references after removals or renames.

See [references/review-and-land.md](references/review-and-land.md).

### 5. Land it

The implementer edits the working tree; **the orchestrator commits.** Commit only after the gates pass
and the diff holds. If rework is needed, send a delta brief with `--resume-last` or `--session <id>`,
then review again.

## Autonomy and permissions

In headless `-p` mode, Kimi always runs in **auto permission mode** and never asks for approval. Kimi
rejects `--prompt` combined with `--yolo`, `--auto`, or `--plan`, so the relay passes none of them and
offers no `--read-only` or `--full-access` option. There is no CLI-enforced read-only mode: inspect
`touchedFiles` and the diff after every run. That diff, not a flag, is the guarantee of what changed.

## Authorization model

Delegation is something the human opts into. Once they have ("run this queue", "proceed"), committing

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

declared (1 observation(s))

Network

none-observed

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (1)

const script = join(dirname(fileURLToPath(import.meta.url)), "../../delegate-setup/scripts/lane.mjs");

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Kimi Delegate](https://modelsatlas.com/skills/amelnagdy/kimi-delegate/badge.svg)](https://modelsatlas.com/skills/amelnagdy/kimi-delegate/)

Not your listing, or something out of date? Claim or update your listing.