flutter-mcp-toolkit-control
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from a running Flutter application's UI tree and uses it to guide agent behavior.
- Ingestion points: The
semantic_snapshotandhot_reload_and_capturetools return widget labels, values, hints, and error messages from the target application. - Boundary markers: The skill instructions do not specify any delimiters or warnings to the agent to disregard instructions that might be embedded within UI labels or text fields.
- Capability inventory: The agent can perform significant actions based on UI data, including tapping widgets (
tap_widget), entering text (enter_text,fill_form), and navigating between routes (navigate). - Sanitization: No sanitization or validation of the application-provided text is described before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill provides tools to trigger Flutter development operations such as
hot_reload_flutterandhot_restart_flutter. While these are legitimate developer tools for a toolkit, they allow the agent to execute code changes made to the underlying Dart source files within the application's runtime environment.
Audit Metadata