kani
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and Makefile reference the 'prover-tools' utility, which is fetched from the author's GitHub repository (leynos/rust-prover-tools).
- [REMOTE_CODE_EXECUTION]: The Makefile uses 'uv tool run' to execute the 'prover-tools' CLI directly from a remote Git repository source, which is pinned to a specific commit for integrity.
- [COMMAND_EXECUTION]: The skill facilitates the installation of the 'kani-verifier' tool via 'cargo install' and manages verification runs using 'cargo kani' within the user's workspace.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to process and maintain Rust source code and verification harnesses.
- Ingestion points: Rust source code and Kani harness files in the repository.
- Boundary markers: Absent.
- Capability inventory: Orchestration of 'cargo install', 'cargo kani', and 'uv tool run'.
- Sanitization: Absent; the skill interacts directly with code stored in the environment.
Audit Metadata