kuikly-multi-module-config
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of submodule names which are subsequently used in shell commands and build file templates.
- Ingestion points: User input collection for submodule names ('子模块名称') in
SKILL.md. - Boundary markers: No explicit markers or warnings are present to prevent command injection via the module name variable.
- Capability inventory: The skill utilizes file writing (
cat), directory creation (mkdir), and build file modifications inSKILL.md,references/MAIN_MODULE_CONFIG.md, andreferences/SUBMODULE_CONFIG.md. - Sanitization: No sanitization logic is provided for the user-supplied strings before interpolation into commands.
- [COMMAND_EXECUTION]: The skill uses shell commands to automate the creation of project directories and configuration files.
- Evidence:
mkdir -pandcat >commands inreferences/SUBMODULE_CONFIG.mdare used to set up the Android and KMP source structure.
Audit Metadata