kotlin-tooling-kotlin-toolchain
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
kotlinCLI andsdk(SDKMAN) for project lifecycle tasks including initialization (kotlin init), building (kotlin build), testing (kotlin test), and running checks (kotlin check). - [REMOTE_CODE_EXECUTION]: The instructions describe the use of checked-in build wrappers (
./kotlin) which are designed to download the toolchain CLI. It also highlights that local build plugins defined within a project are compiled and executed by the toolchain during the build process. - [EXTERNAL_DOWNLOADS]: The skill references external sources for installation and documentation, such as the official JetBrains Toolchain website and repository (
kotlin-toolchain.org,github.com/JetBrains/kotlin-toolchain), and the SDKMAN package manager. - [INDIRECT_PROMPT_INJECTION]: The skill processes declarative configuration files (
project.yaml,module.yaml) which could originate from untrusted sources. To mitigate this, the skill provides specific security guidance, advising the agent to treat repo-supplied scripts and plugins as executable code, review repository definitions, and ignore imperative text within configuration comments.
Audit Metadata