aivo-kmp
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill specifies several Maven dependencies within the
io.github.abdallah-elsobkygroup, includingaivo-sdk,sdk-core, andsdk-runtime. These are official library components provided by the author for the Aivo SDK ecosystem. - [CREDENTIALS_UNSAFE]: The instructions explicitly promote secure API key management. It provides code examples for injecting secrets at runtime using platform-specific mechanisms (e.g., Android
BuildConfig, iOSNSProcessInfo, and JVM environment variables) and warns against hardcoding sensitive information. - [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for processing user input through LLM orchestration via the
streamChatmethod. While this creates a standard attack surface for indirect prompt injection, the framework provides structured agent definitions and system prompts to manage agent boundaries. - [DYNAMIC_EXECUTION]: The skill includes a custom tool definition DSL for extending agent capabilities. The provided implementation example (tax calculation) uses pure Kotlin logic and does not involve unsafe execution of arbitrary commands or untrusted code.
Audit Metadata