Atlas / Skills / maxrave-dev / kotlin-footguns

kotlin-footgunsCAUTION

skills/maxrave-dev/kotlin-footguns

Battle-tested agent skills mapping the footguns of Kotlin, Compose Multiplatform and the desktop JVM — mined from a production music app, not from documentation.

Verdict
CAUTION
Grade
B
Trust score
89 /100
Version
—
Hosts
5 documented
License
GPL-3.0
Stars
1,198
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

By [maxrave-dev](https://github.com/maxrave-dev) — creator and maintainer of SimpMusic, the 10.8k-star cross-platform music app every lesson in this repository was mined from.

[](https://skills.sh/maxrave-dev/kotlin-footguns) [](https://github.com/maxrave-dev/SimpMusic) [](https://github.com/maxrave-dev) [](https://github.com/sponsors/maxrave-dev) [](https://www.buymeacoffee.com/maxrave) [](https://www.simpmusic.org/blogs) [](LICENSE)

224 battle-tested traps mapping the footguns of Kotlin, Compose Multiplatform and desktop JVM development, packaged as nine agent skills plus a scanner that checks a change against them. Mined from a production codebase, not written from documentation.

The traps are grouped into nine area skills in the open agent-skills format, readable by Claude Code and any coding agent that understands the format — and just as readable by a human. Each area skill is an index of its traps; each trap is a standalone markdown file the agent opens when the work in front of it matches. The corpus is 27,000+ lines across 224 files, and in most of them the largest section is Traps: the specific ways a technique fails in practice, each paired with a way to verify the failure and the fix on your own tree.

Why this repository exists

Read from source at commit e73566dc697fOBSERVED · 2026-10-12
02

Install

Commands as the repository documents them. They are shown, not run.

git clone <url> /tmp/fresh-check && cd /tmp/fresh-check && git submodule status
03

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
codexmentioned
copilotmentioned
cursormentioned
windsurfmentioned
04

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: compose-screens-footguns
description: "Compose screen and interaction traps: navigation, adaptive layout, window insets, pagers, toolbars, sheets, list drag and selection, sliders, text fields, settings UI, one-shot effects. Use when layout, gestures or navigation misbehave."
---

# Compose screens footguns: layout, navigation and interaction

32 traps mined from a production Kotlin and Compose Multiplatform app, one short file each
under `references/`. Every file gives the working pattern, the **Traps** (the specific ways it
fails in practice, and why), and a **Verifying it** section with commands to run against the
user's own tree.

**How to use this index.** Match the code about to be written, or the symptom being chased,
against the entries below: each names its topic and the symptom that should send you to it. Read
every file that plausibly applies with the Read tool before proposing code or a fix; each is under
150 lines. Where a Verifying command names the source project's paths, substitute the equivalent
paths in the user's tree.

**Cross-references.** A backticked trap name inside a file that is not listed here lives in a
sibling area skill: glob `../*/references/<name>.md` to open it.

## Screens, navigation and adaptive layout

- [`responsive-gate-size-not-platform`](references/responsive-gate-size-not-platform.md) — Gate an adaptive layout on the window's own width-versus-height, never on the platform, and flip every geometry value the gate owns in the same breath — frame sizing, content scale and scrim height. Use when a layout is right on a phone and wrong in a narrow or resized desktop window, when forcing an adaptive flag to one value breaks a different platform's screen, or when artwork swallows the whole page on a wide window.
- [`nav-tab-registration-drift`](references/nav-tab-registration-drift.md) — A top-level tab has to be registered in every navigation surface that holds its own copy of the tab list — bottom bar, rail, and a stylized bar that keeps two lists — plus the graph and the flag that gates it, or the tab exists in code and never renders. The same drift catches a status entry point carried by more than one top app bar, where the missing badge reads as "nothing is running" rather than as a bug. Covers why a tab's ordinal is an identity rather than a position, what a conditional tab needs when it disappears under the user, and why a badge dot needs a ring of the page colour. Use when a newly added tab or badge shows on one surface but not another, when selection highlights the wrong tab after reordering, or when a tab bar overflows once one more tab appears.
- [`type-safe-nav-graph-organization`](references/type-safe-nav-graph-organization.md) — Lay out a type-safe Navigation-Compose graph so it stays readable as the destination list grows — one serializable route object per file grouped by area, area graphs as extension functions on the graph builder, a single transition set on the host, and per-route theming applied by wrapping the screen inside its own entry. Use when a navigation file has grown to hundreds of lines, when route arguments start needing custom types, or when transitions or theming differ between destinations for no stated reason.
- [`collapsing-parallax-toolbar`](references/collapsing-parallax-toolbar.md) — Build a collapsing header from five siblings in one box — four sharing a single scroll state, one driven by a boolean instead — with artwork moved by a graphics layer at half the scroll rate, a title interpolated along a two-segment curve into the pinned bar, and a derived flip point that swaps the floating back button for a real top bar. Use when a parallax header jitters or re-measures while scrolling, when the collapsing title drifts off its intended path, or when the pinned bar appears at the wrong scroll offset after a window resize.
- [`fullscreen-video-gesture-overlay`](references/fullscreen-video-gesture-overlay.md) — The gesture and chrome layers of a fullscreen video screen — tap anywhere to toggle the controls, double-tap either half to seek, an auto-hide timer that every interaction postpones, and a picture-in-picture (PiP) guard that removes both layers. Use when single taps work on only half the screen, when the controls vanish while the user is dragging the seek bar, when the seek thumb snaps back under the finger, when a double-tap produces no ripple or a ripple that never fades, or when app chrome is still drawn over the video inside a small floating window.
- [`nowplaying-pager-no-feedback-loop`](references/nowplaying-pager-no-feedback-loop.md) — A now-playing artwork pager that both follows the player and drives it, without the two writing to each other in a loop — the in-progress-scroll flag covers programmatic animation as well as drags, the seek is dispatched from the settled page only, and the page-difference decision is a pure function outside the UI runtime. Use when a swipe bounces back to the page it came from, when one swipe skips two tracks, when the pager stops following the player after a fast swipe, when swiping backwards restarts the current track instead of going back one, or when a far swipe under shuffle lands on the wrong song.
- [`layered-video-backdrop-pager`](references/layered-video-backdrop-pager.md) — Building a swipeable now-playing page whose layers — a colour backdrop, a full-bleed looping video or image, and a centred square cover — all belong to one pager, with per-page colours taken from the bitmap that page actually painted and a scrim spanning the whole page. Use when a swipe makes the background and the cover slide out of step, when video from one track bleeds into the neighbouring page mid-swipe, when the backdrop colour belongs to the wrong track or flashes black between pages, when the bottom of the video shows through the controls, or when a tap overlay stops the pager from being dragged at all.
- [`desktop-mini-player-window`](references/desktop-mini-player-window.md) — A
05

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (3)

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
skills/desktop-and-build-footguns/SKILL.md:50
- [`buildkonfig-secrets-flavors`](references/buildkonfig-secrets-flavors.md) — Wire build-time configuration into a Kotlin Multiplatform app with BuildKonfig — secrets read from an untracked local pro
Why it matters. asks the agent to read credentials
LOWInventory / provenance · inv.suspicious_name · CWE-1104
skills/media-playback-footguns/references/follower-item-built-from-shared-payload.md
follower-item-built-from-shared-payload.md
Why it matters. member named after an attack tool
Fix. remove or justify
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
skills/desktop-and-build-footguns/references/buildkonfig-secrets-flavors.md:3
description: Wire build-time configuration into a Kotlin Multiplatform app with BuildKonfig — secrets read from an untracked local properties file and injected as generated constants, with the no-secr
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha e73566dc697ffull audit observations/trust-audit/skill/maxrave-dev__kotlin-footguns.json · Report an issue / request a re-scan
06

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-12e73566dc697fCAUTIONB89first audit
07

Questions

What does the kotlin-footguns skill do?

Battle-tested agent skills mapping the footguns of Kotlin, Compose Multiplatform and the desktop JVM — mined from a production music app, not from documentation.

Is kotlin-footguns safe to install?

With care. The audit graded it B (89/100) and found 3 things worth knowing before you trust this skill, listed below with the exact line each was found on.

What can kotlin-footguns access on my machine?

The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.

Which assistants does kotlin-footguns work with?

Its documentation mentions claude-code, codex, copilot, cursor and windsurf. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (e73566dc697f), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement