The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local Python script (scripts/inspect-project.py) to perform static analysis on the target KMP project. The script is invoked with a user-provided root directory and outputs metadata about the project structure in JSON or human-readable format. It is confined to the project directory and performs no unauthorized file system or network operations.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes external content from the target project, which represents a potential attack surface for indirect prompt injection.
Ingestion points: The scripts/inspect-project.py script reads Kotlin source files (.kt), Gradle build scripts (.gradle, .gradle.kts), property files, and version catalogs (.toml).
Boundary markers: The script generates structured JSON output, providing a clear boundary for data processed by the agent.
Capability inventory: The skill possesses capabilities to read project files and generate reports. It references project modification capabilities through separate build-tooling skills but does not include network or sensitive system access.
Sanitization: The analysis script uses specific regular expressions to extract metadata, providing implicit filtering and preventing the direct pass-through of raw, potentially malicious file content into the agent's context.
[SAFE]: No security issues such as obfuscation, credential exposure, privilege escalation, or malicious command patterns were detected. All external links point to official Kotlin documentation from a well-known service.

kotlin-multiplatform