android-kotlin-core
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Android source code (Kotlin and XML), creating an ingestion surface for potential instructions embedded in code. \n
- Ingestion points: Project implementation files analyzed during the mapping and inspection steps (SKILL.md). \n
- Boundary markers: No explicit delimiter or instructions to ignore embedded content are provided. \n
- Capability inventory: The skill can execute local shell commands via
gradlewand a Python script (scripts/run_examples.sh). \n - Sanitization: None identified in the provided instructions. \n- [COMMAND_EXECUTION]: The skill instructs the agent to run local verification commands using
gradlewfor unit tests and a local Python scriptscripts/eval_triggers.py. These are expected development workflows. \n- [EXTERNAL_DOWNLOADS]: The skill contains references to official Android and Kotlin documentation. These links point to well-known, trusted domains (developer.android.com, kotlinlang.org) and do not pose a security risk.
Audit Metadata