kiro-extension

The `kiroScaffold` function, which creates files and directories based on the `file-structure` block in `design.md`, is vulnerable to path traversal. The `cleanPath` variable, derived from user-controlled content in `design.md`, is joined with `process.cwd()` without sufficient sanitization (e.g., removing '..' segments). This allows a malicious user or a compromised AI to craft paths like `../../../../evil.txt`, potentially writing files outside the intended project directory to arbitrary locations on the file system. While the server communicates over stdio (not directly exposed network ports), this file system write vulnerability is critical.