kotlin-build-kmp-gradle-governance
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains no executable scripts or command-line instructions. It functions strictly as a set of cognitive guidelines for an AI agent to perform project structure reviews.
- [SAFE]: All external URL references target official documentation from well-known and trusted sources, including Google (Android Developer), JetBrains (Kotlin and IDE documentation), and Gradle.
- [SAFE]: The skill does not request or use any high-risk tools or permissions; it operates entirely within the chat context to provide feedback on build logic and module boundaries.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided Gradle build files and project layouts. While this creates a surface for indirect prompt injection via comments or strings in the user's code, the risk is mitigated by the skill's limited capability to only provide textual review feedback without performing system-level actions.
- Ingestion points: User-provided module structures,
build.gradle.ktsfiles, and version catalogs. - Boundary markers: Absent.
- Capability inventory: Reasoning and text generation only; no subprocess execution or network operations identified.
- Sanitization: Absent.
Audit Metadata