kotlinpoet
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local utility script
scripts/inspect-project.pydesigned to perform static analysis on the target repository. The script identifies library usage, dependency skew, and potential determinism issues. It operates entirely locally using standard Python libraries, without network access or access to sensitive system directories. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates code generation based on user-provided semantic inputs. It mitigates the risk of source injection by providing explicit instructions and documentation on using KotlinPoet's structured placeholders (e.g.,
%Sfor string literals,%Tfor types,%Nfor names), which handle escaping and prevent arbitrary strings from being interpreted as code. - [EXTERNAL_DOWNLOADS]: The skill references and guides the configuration of KotlinPoet and KSP artifacts. These dependencies are sourced from well-known and trusted organizations, including Square and Google, which is standard for the library's intended use case.
Audit Metadata