review
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external code diffs and Flutter project files, which constitutes a surface for indirect prompt injection. Malicious instructions could be embedded in code comments or strings within a project to attempt to deceive the reviewer.
- Ingestion points: User-provided diffs and project files like pubspec.yaml and analysis_options.yaml.
- Boundary markers: The instructions do not define specific delimiters to separate the user-provided code from the skill's instructions.
- Capability inventory: The skill instructs the agent to execute development tools such as flutter analyze and dart format.
- Sanitization: No input sanitization or validation of the processed code is specified.
- [COMMAND_EXECUTION]: The skill directs the agent to run official development tools (flutter analyze and dart format) on the project files. These are well-known, legitimate CLI tools for the Dart ecosystem and are used here for their intended purpose of code verification.
Audit Metadata