The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a running Flutter application which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: External data enters the agent context through semantic_snapshot (extracting widget labels and text values), get_app_errors (retrieving application exception messages), and get_screenshots (capturing visual UI content that could be processed via OCR).
Boundary markers: The skill instructions do not provide delimiters or "ignore instructions" warnings to help the agent distinguish between application content and legitimate task instructions.
Capability inventory: The skill possesses capabilities to write files to the local system (get_screenshots saving to fileUrls) and initiate network connections (connect_debug_app via WebSockets).
Sanitization: There is no evidence of sanitization or filtering of the application-provided text before it is returned to the agent's context.
[DATA_EXFILTRATION]: The connect_debug_app tool allows the agent to connect to arbitrary WebSocket URIs via the targetId parameter. While typically used for local debugging (e.g., 127.0.0.1), the tool lacks validation to prevent connections to remote, attacker-controlled servers. This could be used to transmit sensitive application state or screenshots to an external location.

flutter-mcp-toolkit-inspect