aivo-kmp

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill specifies several Maven dependencies within the io.github.abdallah-elsobky group, including aivo-sdk, sdk-core, and sdk-runtime. These are official library components provided by the author for the Aivo SDK ecosystem.
  • [CREDENTIALS_UNSAFE]: The instructions explicitly promote secure API key management. It provides code examples for injecting secrets at runtime using platform-specific mechanisms (e.g., Android BuildConfig, iOS NSProcessInfo, and JVM environment variables) and warns against hardcoding sensitive information.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for processing user input through LLM orchestration via the streamChat method. While this creates a standard attack surface for indirect prompt injection, the framework provides structured agent definitions and system prompts to manage agent boundaries.
  • [DYNAMIC_EXECUTION]: The skill includes a custom tool definition DSL for extending agent capabilities. The provided implementation example (tax calculation) uses pure Kotlin logic and does not involve unsafe execution of arbitrary commands or untrusted code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 02:18 PM