flutter-mcp-cli-runtime-validation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the Dart CLI.
- Evidence: The skill specifies commands such as
dart run mcp_server_dart/bin/flutter_mcp_toolkit.dart validate-runtimeto perform app validation. - Context: These commands target local file paths and are used for the stated purpose of Flutter development support.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a running Flutter application, which represents a potential injection surface.
- Ingestion points: Data is ingested through toolkit extensions such as
ext.mcp.toolkit.app_errorsandext.mcp.toolkit.view_details(layout metadata). - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat data from these extensions as untrusted or to ignore embedded instructions.
- Capability inventory: The agent has capabilities for command execution via
dart runand file system writes for saving screenshots. - Sanitization: The skill lacks instructions for sanitizing or validating application-generated data (e.g., error messages or widget metadata) before the agent processes it.
Audit Metadata