flutter-mcp-toolkit-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The document shows examples embedding VM service tokens directly in command-line URIs (e.g., ws://127.0.0.1:8181//ws), which would require an agent to substitute and emit secret tokens verbatim in commands/flags.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The curl|bash link to a raw install.sh on a single GitHub user repo is high-risk (directly executing a remote shell script from an individual/unknown account), while the other URLs are documentation/site links and not direct executables.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The SKILL.md contains a command that fetches and pipes remote code to a shell (curl -fsSL https://raw.githubusercontent.com/Arenukvern/mcp_flutter/main/install.sh | bash), which executes remote code at runtime and is therefore a high-confidence risk.