di-migration

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs legitimate project migration tasks. It identifies existing DI frameworks (Hilt, Dagger, etc.) and provides a per-module conversion loop to Koin 4.x.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it processes user-pasted source code for conversion. However, it implements strong mitigations including a mandatory 'Plan' step where the agent must stop for user confirmation, a leaf-first migration strategy to minimize blast radius, and a per-module validation loop that requires explicit user acknowledgement before proceeding. These practices effectively mitigate the risk of accidental or malicious instructions in the processed data affecting the agent's behavior.
  • [CREDENTIALS_SAFE]: The skill includes security-conscious instructions regarding the Kotzilla SDK. It explicitly advises the user that kotzilla.json contains an API key and recommends using .gitignore and CI secrets to protect it, rather than hardcoding or exposing it.
  • [EXTERNAL_DOWNLOADS]: The skill references official dependencies from Maven Central (io.insert-koin artifacts) and documentation from the vendor's domain (insert-koin.io). These are recognized as trusted vendor resources for this skill and do not represent a security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 10:58 PM