di-migration
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate project migration tasks. It identifies existing DI frameworks (Hilt, Dagger, etc.) and provides a per-module conversion loop to Koin 4.x.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it processes user-pasted source code for conversion. However, it implements strong mitigations including a mandatory 'Plan' step where the agent must stop for user confirmation, a leaf-first migration strategy to minimize blast radius, and a per-module validation loop that requires explicit user acknowledgement before proceeding. These practices effectively mitigate the risk of accidental or malicious instructions in the processed data affecting the agent's behavior.
- [CREDENTIALS_SAFE]: The skill includes security-conscious instructions regarding the Kotzilla SDK. It explicitly advises the user that
kotzilla.jsoncontains an API key and recommends using.gitignoreand CI secrets to protect it, rather than hardcoding or exposing it. - [EXTERNAL_DOWNLOADS]: The skill references official dependencies from Maven Central (io.insert-koin artifacts) and documentation from the vendor's domain (insert-koin.io). These are recognized as trusted vendor resources for this skill and do not represent a security risk.
Audit Metadata