build-tools-bump-gradle-api
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate build automation tasks using project-specific scripts and standard build tools.
- [COMMAND_EXECUTION]: Executes repository-local scripts (update-verification-metadata.sh) and Gradle commands (gradlew) to resolve dependencies and compile the project. These actions are consistent with the skill's stated purpose of managing build environment versions.
- [INDIRECT_PROMPT_INJECTION]: The skill reads project configuration from local.properties and source code from GradlePluginVariant.kt. While this constitutes a data ingestion surface, the risk is minimal as the skill only extracts specific version constants and environment flags. Evidence Chain: 1. Ingestion points: local.properties, GradlePluginVariant.kt. 2. Boundary markers: Absent. 3. Capability inventory: Shell commands (grep, sed), local script execution, and Gradle tasks. 4. Sanitization: Absent.
Audit Metadata