kmp-gradle-doctor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited kmp-gradle-doctor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set $PLUGIN_ROOT ($env:PLUGIN_ROOT in PowerShell; same path suffix) once: host plugin-root variable when defined (Claude Code: PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"), else this plugin root's absolute path. Bundled commands use it.
Use for KMP build failures; Gradle DSL changes; plugin version alignment; target declarations; source-set hierarchy; Android-KMP plugin migration; dependency placement; KSP/KAPT; detekt/ktlint; Compose compiler; CI; test task selection.
settings.gradle(.kts)build.gradle(.kts)gradle/libs.versions.tomlgradle.propertiesgradle/wrapper/gradle-wrapper.properties python3 "$PLUGIN_ROOT/scripts/kmp_inspector.py" --root <project-root>clean unless cache state is suspected.kdoctor only if installed or explicitly approved to install; scope: host/toolchain readiness.Use project static inspection first. Then consider host diagnostics when symptoms include Xcode selection, CocoaPods/Ruby, Android Studio plugin, JDK/JAVA_HOME, simulator, or iOS Gradle task failures unrelated to source changes.
Useful checks:
xcode-select -p
xcodebuild -version
java -version
./gradlew -version
kdoctor -vDo not install/update KDoctor, CocoaPods, Ruby, Xcode, Android Studio, JDKs, or SDK tools unless the user explicitly asked for environment setup.
Medium/large KMP projects: inspect whether repeated configuration is centralized.
build-logic/ or buildSrc/ convention plugins when many modules repeat setup.pluginManagement and dependencyResolutionManagement in settings.dependsOn() edges can disable the default hierarchy template; keep them only for real non-default sharing needs.commonMainandroidMainiosMain or exact native source setjvmMain or named desktop source setcommonMain, verify every configured target publishes the artifact.Android-targeting KMP library modules on modern AGP:
com.android.kotlin.multiplatform.library.kotlin { android { ... } }.android {} block after Android-KMP library plugin migration.buildTypes or productFlavors in that module.androidResources { enable = true } if Android resources or Compose resources need Android resource processing.withJava() for Java sources.localDependencySelection for variant-rich Android library consumption.Prefer the narrowest proof:
./gradlew :shared:compileKotlinMetadata
./gradlew :shared:compileKotlinIosSimulatorArm64
./gradlew :shared:jvmTest
./gradlew :shared:allTests
./gradlew :androidApp:assembleDebug
./gradlew :desktopApp:runTask names vary by module/target; use ./gradlew :module:tasks --all when uncertain.
detekt checks all commonMain, iosMain, and androidMain code.api(...) dependencies, review whether public surface is too broad.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.