The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or unauthorized data access techniques were identified in the skill content or code samples.
[SAFE]: External dependencies are restricted to official, well-known Flutter packages sourced from the standard Dart registry.
[SAFE]: Implementation guidance for sensitive components, such as the Apple Push Notification service (.p8) authentication key, adheres to official security guidelines and promotes safe handling practices.
[PROMPT_INJECTION]: The skill facilitates the ingestion of data from an external source (Firebase Cloud Messaging), creating a surface for potential indirect prompt injection.
Ingestion points: Untrusted data enters the application context via RemoteMessage objects in the firebaseMessagingBackgroundHandler and onMessage listeners described in handlers.md and SKILL.md.
Boundary markers: The instructions do not define explicit boundary markers or provide warnings to the model regarding the potential for embedded instructions within notification payloads.
Capability inventory: The skill is limited to UI notification display and registration logic; it does not utilize or request high-risk capabilities such as arbitrary shell execution, file system modification, or network exfiltration tools.
Sanitization: The code samples demonstrate the direct use of payload strings for notification titles and bodies without explicit sanitization or validation of the content.

push-notifications