kta-module
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the local
./gradlewcommand to verify that the newly scaffolded module compiles correctly. This is a standard development practice for Android projects and is targeted at the newly created module directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files including
gradle/libs.versions.toml,settings.gradle.kts, and siblingbuild.gradle.ktsfiles to discover project conventions. Boundary markers to prevent the agent from obeying instructions embedded in these files are absent. The skill possesses file-writing capabilities and shell command execution viagradlew. No explicit sanitization or validation of the ingested external content is performed before interpolation into templates, though the risk is localized to the development environment.
Audit Metadata