dart-flutter-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides architectural templates for processing untrusted data from external sources and user input fields. While it strongly advocates for type safety and null safety, it lacks patterns for content-level sanitization, creating a potential surface for indirect prompt injection if the processed data is used to influence agent behavior.
- Ingestion points: The UserApiDataSource in SKILL.md reads data from API responses using Dio, and the AuthCubit processes user-provided authentication credentials.
- Boundary markers: The provided code snippets do not include explicit delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: The examples demonstrate the ability to perform network requests, access secure local storage, and modify application navigation.
- Sanitization: The patterns focus on logical safety (null promotion, mounted checks) rather than sanitizing the content of external strings against injection.
- [SAFE]: The skill references official documentation and established community resources for Dart and Flutter development. All external links and package references target reputable sources within the development ecosystem.
Audit Metadata