flutter-mcp-toolkit-setup
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads an installation script from the author's own GitHub repository (
Arenukvern/mcp_flutter). This is a legitimate vendor resource used for setting up the toolkit. - [REMOTE_CODE_EXECUTION]: The documentation provides a command to download and execute an installation script (
curl -fsSL ... | bash). While this pattern is generally high-risk, in this context it is the intended method for installing the vendor's own software and targets the vendor's verified infrastructure. - [COMMAND_EXECUTION]: The skill instructs the agent to execute various local CLI commands (
flutter-mcp-toolkit,fmtk,flutter pub add,make build) to diagnose issues, rebuild the project, and manage dependencies. These are standard development tasks consistent with the skill's purpose. - [DATA_EXFILTRATION]: No patterns of sensitive data exfiltration were found. Network activity is limited to downloading the official installation script and connecting to the local Dart VM service (
127.0.0.1) for debugging purposes. - [PROMPT_INJECTION]: The skill contains no instructions aimed at overriding AI safety filters or extracting system prompts.
Audit Metadata