kotlin-tooling-native-build-performance
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled bash script (
scripts/audit-native-build.sh) to perform static analysis of the project configuration. The script is restricted to read-only operations and usesgrepto detect performance issues. It does not require elevated privileges or perform network access. - [PROMPT_INJECTION]: The skill's workflow for auditing project files presents an indirect prompt injection surface.
- Ingestion points: Content is read from
gradle.properties,build.gradle.kts, and GitHub Actions workflow files (referenced inSKILL.mdandscripts/audit-native-build.sh). - Boundary markers: The instructions in
SKILL.mddo not define delimiters or provide specific warnings to ignore embedded instructions within the ingested project files. - Capability inventory: The agent has the capability to modify project files and execute shell commands based on findings (as described in
SKILL.mdStep 2). - Sanitization: No evidence of sanitization or filtering of the retrieved project data before processing was detected.
Audit Metadata