kmp-html-entity-decoder
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional, providing Kotlin code snippets for HTML entity decoding. No network operations, sensitive file access, or remote code execution patterns were identified.
- [COMMAND_EXECUTION]: The inclusion of shell commands (grep) is for local verification purposes, such as searching source code for specific implementation patterns. These commands do not involve untrusted input or remote targets.
- [INDIRECT_PROMPT_INJECTION]: While the skill defines functions that process user-supplied strings (HTML entities), it explicitly warns that decoding is not sanitizing and advises against using the output in sensitive contexts like markup or shell commands, adhering to security best practices.
- [NO_CODE]: The skill does not distribute executable scripts or binaries; it provides code templates for developers to implement manually in their own projects.
Audit Metadata