Is kmp-security-privacy safe to install?

SaferSkills independently audited kmp-security-privacy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/kotlin-multiplatform/skills/kmp-security-privacy/SKILL.md · 1 file

plugins/kotlin-multiplatform/skills/kmp-security-privacy/SKILL.md1.8 KB · Markdown

name: kmp-security-privacy

description: Review Kotlin Multiplatform security and privacy across secure storage, tokens, Ktor auth, TLS, certificate pinning, logging redaction, runtime protection, platform APIs, and commonMain boundaries.

KMP Security And Privacy

Use for KMP secrets, tokens, authentication, secure storage, logging redaction, network security, privacy-sensitive data, runtime app protection, and platform security boundaries.

Review Flow

Search shared code, tests, configs, and logs for secret-like names and literals.
Find where tokens, refresh tokens, device identifiers, PII, and encryption keys live.
Confirm common code exposes interfaces and policies while platform source sets own storage implementation.
Review Ktor auth, refresh-token loops, retries, TLS/certificate pinning, and redaction.
Check CI/release examples do not contain signing, keystore, App Store, Maven Central, or token material.

Rules

commonMain should not hardcode secrets or own platform storage implementation.
Android sensitive key-value storage should use Android-backed secure storage.
iOS sensitive key-value storage should use Keychain-backed storage.
Shared logging APIs must redact tokens, auth headers, refresh responses, PII, and request bodies unless explicitly safe.
Refresh-token requests must avoid recursive auth interception.
Certificate pinning and runtime app protection are risk-based choices; do not add them as universal defaults.
Hardware-backed encrypted storage libraries and runtime app protection SDKs are optional. Verify threat model, target support, maintenance, incident response, and policy before adoption.

Output

Lead with:

security verdict
exact files and flows reviewed
hard blockers
platform-boundary issues
redaction gaps
network/auth risks
tests or manual checks needed

kmp-security-privacy— agent skill

Is kmp-security-privacy safe to install?

KMP Security And Privacy

Review Flow

Rules

Output

Audit the pieces. Scan the whole. Decide.