skills/trancee/skills/lincheck/Gen Agent Trust Hub

lincheck

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill uses a Python helper script (scripts/inspect-project.py) that reads local source code and build configuration files from a user-provided path. This data is then processed and ingested into the agent's context, creating an attack surface for instructions embedded within the target project's files.
  • Ingestion points: scripts/inspect-project.py reads content from .kt, .java, .gradle, .toml, and .xml files found in the project root.
  • Boundary markers: The script outputs structured JSON data which is then interpreted by the agent.
  • Capability inventory: The skill is designed for project inspection and testing guidance; it does not possess capabilities for network operations, file writing, or command execution beyond the initial analysis script.
  • Sanitization: The analysis logic uses regular expressions to isolate specific library usage patterns and keywords, which filters out the majority of unrelated file content, though matched code snippets are included in the output.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for adding the Lincheck library (org.jetbrains.lincheck:lincheck) as a dependency. This library is a well-known tool produced by JetBrains. All external documentation and repository links point to official Kotlin and JetBrains sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 05:02 PM