Agent skill · Audited from source

kotlin-tooling-agp9-migration

skill · kotlin/kotlin-agent-skillsApache-2.0 licenceAudited 21 Oct 2026 · source 25b8117b6cd6

★ 1,090pushed todayversion 1.0.0
✕BLOCKGrade D · 69/100 · 3 findings · 25b8117
1,090repo stars · whole kotlin/kotlin-agent-skills

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 25b8117b6cd6 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 3 findings, 2 critical or high. What it does: Migrates Kotlin Multiplatform (KMP) projects to Android Gradle Plugin 9.0+. Handles plugin replacement (com.android.kotlin.multiplatform.library), module splitting, DSL migration, and the new default project structure.…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “kotlin-tooling-agp9-migration (kotlin/kotlin-agent-skills)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/kotlin/kotlin-tooling-agp9-migration

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Prompt injection” in SKILL.md:427. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 21 Oct 2026

Trust score69/100✕BLOCK D
0 critical2 high1 medium0 low0 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN1
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS0
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL2
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: instruction override, no behavioural pass.

Findings (3)

HIGHPrompt injectionprompt.hide_from_user · SKILL.md:427
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
**Before migrating**, inventory all plugins in the project and check each against that table. If any plugin is broken without workaround, inform the user. If plugins need opt-out flags, add them to`gr
Why
asks the agent to act without the user's knowledge
Fix
—
HIGHPrompt injectionprompt.hide_from_user · references/PLUGIN-COMPATIBILITY.md:57
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
3. **If any plugin is broken without workaround**, inform the user — they may need to wait for a plugin update or remove it
Why
asks the agent to act without the user's knowledge
Fix
—

Audit 0.4.1 · source sha 25b8117b6cd6 · 21 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherkotlin GitHub organizationOwner of the repository this skill is read from
  • Source folderkotlin/kotlin-agent-skills/skills/kotlin-tooling-agp9-migrationThe exact folder we audited
  • LicenceApache-2.0As the repository states it
  • Commit pinned for this verdict25b8117b6cd6A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Migrates Kotlin Multiplatform (KMP) projects to Android Gradle Plugin 9.0+. Handles plugin replacement (com.android.kotlin.multiplatform.library), module splitting, DSL migration, and the new default project structure.…

---
name: kotlin-tooling-agp9-migration
description: >
  Migrates Kotlin Multiplatform (KMP) projects to Android Gradle Plugin 9.0+.
  Handles plugin replacement (com.android.kotlin.multiplatform.library), module
  splitting, DSL migration, and the new default project structure. Use when
  upgrading AGP, when build fails due to KMP+AGP incompatibility, or when the
  user mentions AGP 9.0, android multiplatform plugin, KMP migration, or
  com.android.kotlin.multiplatform.library.
license: Apache-2.0
metadata:
  author: JetBrains
  version: "1.0.0"
---

# KMP AGP 9.0 Migration

Android Gradle Plugin 9.0 makes the Android application and library plugins incompatible
with the Kotlin Multiplatform plugin in the same module. This skill guides you through the
migration.

## Step 0: Analyze the Project

Before making any changes, understand the project structure:
1. Read `settings.gradle.kts` (or `.gradle`) to find all modules
2. For each module, read its `build.gradle.kts` to identify which plugins are applied
3. Check if the project uses a Gradle version catalog (`gradle/libs.versions.toml`). If it exists,
   read it for current AGP/Gradle/Kotlin versions. If not, find versions directly in `build.gradle.kts`
   files (typically in the root `buildscript {}` or `plugins {}` block). **Adapt all examples in this
   guide accordingly** — version catalog examples use `alias(libs.plugins.xxx)` while direct usage
   uses `id("plugin.id") version "x.y.z"`
4. Read `gradle/wrapper/gradle-wrapper.properties` for the Gradle version
5. Check `gradle.properties` for any existing workarounds (`android.enableLegacyVariantApi`)
6. Check for `org.jetbrains.kotlin.android` plugin usage — AGP 9.0 has built-in Kotlin and this plugin must be removed
7. Check for `org.jetbrains.kotlin.kapt` plugin usage — incompatible with built-in Kotlin, must migrate to KSP or `com.android.legacy-kapt`
8. Check for third-party plugins that may be incompatible with AGP 9.0 (see "Plugin Compatibility" section below)

If Bash is available, run `scripts/analyze-project.sh` from this skill's directory to get a structured summary.

### Classify Each Module

For each module, determine its type:

| Current plugins                                                          | Migration path                              |
|--------------------------------------------------------------------------|---------------------------------------------|
| `kotlin.multiplatform` + `com.android.library`                           | **Path A** — Library plugin swap            |
| `kotlin.multiplatform` + `com.android.application`                       | **Path B** — Mandatory Android split        |
| `kotlin.multiplatform` with multiple platform entry points in one module | **Path C** — Full restructure (recommended) |
| `com.android.application` or `com.android.library` (no KMP)              | See "Pure Android Tips" below               |

### Determine Scope

- **Path B is mandatory** for any module combining KMP + Android application plugin
- **Path C is recommended** when the project has a monolithic `composeApp` (or similar) module
  containing entry points for multiple platforms (Android, Desktop, Web). This aligns with the
  new JetBrains default project structure where each platform gets its own app module.
- **Ask the user** whether they want Path B only (minimum required) or Path C (recommended full restructure)

## Path A: Library Module Migration

Use this when a module applies `kotlin.multiplatform` + `com.android.library`.

See [references/MIGRATION-LIBRARY.md](references/MIGRATION-LIBRARY.md) for full before/after code.

Summary:

1. **Replace plugin**: `com.android.library` → `com.android.kotlin.multiplatform.library`
2. **Remove `org.jetbrains.kotlin.android`** plugin if present (AGP 9.0 has built-in Kotlin support)
3. **Migrate DSL**: Move config from top-level `android {}` block into `kotlin { android {} }`:
   ```kotlin
   kotlin {
       android {
           namespace = "com.example.lib"
           compileSdk = 35
           minSdk = 24
       }
   }
   ```
4. **Rename source directories** (only if the module uses classic Android layout instead of KMP layout):
   - `src/main` → `src/androidMain`
   - `src/test` → `src/androidHostTest`
   - `src/androidTest` → `src/androidDeviceTest`
   - If the module already uses `src/androidMain/`, no directory renames are needed
5. **Move dependencies** from top-level `dependencies {}` into `sourceSets`:
   ```kotlin
   kotlin {
       sourceSets {
           androidMain.dependencies {
               implementation("androidx.appcompat:appcompat:1.7.0")
           }
       }
   }
   ```
6. **Enable resources** explicitly if the module uses Android or Compose Multiplatform resources:
   ```kotlin
   kotlin {
       android {
           androidResources { enable = true }
       }
   }
   ```
7. **Enable Java** compilation if module has `.java` source files:
   ```kotlin
   kotlin {
       android {
           withJava()
       }
   }
   ```
8. **Enable tests** explicitly if the module has unit or instrumented tests:
   ```kotlin
   kotlin {
       android {
           withHostTest { isIncludeAndroidResources = true }
           withDeviceTest {
               instrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
           }
       }
   }
   ```
9. **Update Compose tooling dependency**:
   ```kotlin
   // Old: 
   debugImplementation(libs.androidx.compose.ui.tooling)
   // New:
   androidRuntimeClasspath(libs.androidx.compose.ui.tooling)
   ```
10. **Publish consumer ProGuard rules** explicitly if applicable:
    ```kotlin
    kotlin {
        android {
            consumerProguardFiles.add(file("consumer-rules.pro"))
        }
    }
    ```
11. **Resolve Sub-dependency Variants (Product Flavors / Build Types)**:
    Because the new KMP Android library plugin enforces a single-variant architecture, it does not natively understand how to resolve dependencies that publish multiple variants (like

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 25b8117

git clone https://github.com/kotlin/kotlin-agent-skills
git -C kotlin-agent-skills checkout 25b8117b6cd6

The author documents no install command, so this uses the repository directly. Our verdict covers commit 25b8117b6cd6 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 25b8117b6cd6

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/kotlin/kotlin-tooling-agp9-migration/badge.svg)](https://modelsatlas.com/skills/kotlin/kotlin-tooling-agp9-migration/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/kotlin/kotlin-tooling-agp9-migration/badge.svg)](https://modelsatlas.com/skills/kotlin/kotlin-tooling-agp9-migration/)

Questions about kotlin-tooling-agp9-migration

What does the kotlin-tooling-agp9-migration skill do?
A collection of AI agent skills useful for projects using Kotlin language
Is kotlin-tooling-agp9-migration safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can kotlin-tooling-agp9-migration access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (25b8117b6cd6), read on 2026-10-21. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.