kotlin-binary-compatibility
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files through a dedicated Python inspector script.
- Ingestion points: The
scripts/inspect-project.pyscript readsbuild.gradle,build.gradle.kts,settings.gradle,gradle.properties, andlibs.versions.tomlfiles from a user-specified root directory. - Boundary markers: The script filters content by extracting specific configuration keys and versions via regex and TOML parsing, avoiding raw text ingestion of the entire codebase.
- Capability inventory: The skill is limited to read-only operations on project metadata and does not have network, file-write, or arbitrary command execution capabilities.
- Sanitization: The inspection script outputs results in a structured JSON format, which prevents extracted project data from being misinterpreted as instructions by the agent.
- [EXTERNAL_DOWNLOADS]: The skill references established Kotlin documentation and development tools.
- The documentation links point to official Kotlin sites (kotlinlang.org) and the official Kotlin GitHub repository.
- These references are informational and do not involve untrusted third-party code execution.
Audit Metadata