skills/trancee/skills/lincheck/Gen Agent Trust Hub

lincheck

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a provided Python script (scripts/inspect-project.py) to analyze the local project environment. The script identifies Lincheck versions, API usage, and test configurations through static analysis of source and build files.
  • [INDIRECT_PROMPT_INJECTION]: The inspect-project.py script acts as a data ingestion point, reading local project files including Kotlin/Java source code, Maven POMs, and Gradle build scripts. While the script performs read-only regex matching, the resulting summaries and warnings are presented to the agent, creating a theoretical attack surface for indirect prompt injection via the analyzed codebase.
  • Ingestion points: Reads project files (.kt, .java, build.gradle, pom.xml, libs.versions.toml) via inspect-project.py.
  • Boundary markers: None explicitly implemented within the script output; the agent relies on structured JSON or plain text reporting.
  • Capability inventory: The script is limited to file system read operations and regex processing; it contains no file-write, network, or arbitrary command execution capabilities.
  • Sanitization: Uses standard encoding handling (errors="replace") during file reads.
  • [EXTERNAL_DOWNLOADS]: The skill documentation refers to and recommends fetching the latest Lincheck releases and documentation from official sources, including JetBrains' GitHub repositories and the Kotlin language guide.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 03:40 PM
Security Audit — agent-trust-hub — lincheck