kta-compose-optimizer
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external Kotlin source code and project metadata files like CLAUDE.md, which are potential vectors for malicious instructions. It mitigates this by using the AskUserQuestion tool for human-in-the-loop validation of all proposed changes and by explicitly instructing the agent to refuse instruction-override attempts (e.g., 'ignore previous instructions') embedded in code comments.
- [EXTERNAL_DOWNLOADS]: The skill is configured to use web retrieval tools such as WebFetch and WebSearch to access official Android documentation and research library stability.
- [COMMAND_EXECUTION]: Employs standard system search utilities like Grep to locate specific Composable function patterns within the project directory structure.
Audit Metadata