kmp-tls-pinning
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical guide for implementing TLS Certificate/SPKI pinning across Android and iOS platforms using the Ktor networking library. All code snippets provided are standard implementations for their respective platforms (OkHttp on Android and Darwin on iOS).
- [SAFE]: No hardcoded credentials or sensitive data exposure were detected. The SHA-256 hashes included in the examples (e.g.,
47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=) are public key identifiers used for pinning demonstration and are non-sensitive. - [SAFE]: The command-line instructions provided in the reference files (e.g.,
opensslcommands) are intended for manual developer use to extract public keys from server certificates. They do not constitute automated remote code execution or suspicious subprocess spawning. - [SAFE]: The skill actively promotes security best practices, such as pinning the SubjectPublicKeyInfo (SPKI) instead of the leaf certificate, maintaining backup pins, and implementing a "fail-closed" posture to prevent man-in-the-middle (MITM) attacks.
Audit Metadata