flutter-mcp
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill references CLI commands for the
flutter-mcp-toolkitutility, such asdoctorandpermissions. These are standard administrative actions for local development tools to verify environment setup and manage required system permissions (e.g., macOS screen recording). - [REMOTE_CODE_EXECUTION]: The
fmt_evaluate_dart_expressiontool is used to read runtime state from the target Flutter application. While this involves dynamic execution, it is the primary intended function for debugging and inspecting a running app. - [PROMPT_INJECTION]: The skill facilitates reading external data from the target application (UI tree via
fmt_semantic_snapshotand errors viafmt_get_app_errors), creating a surface for indirect prompt injection. - Ingestion points: UI snapshots and application error messages from
SKILL.mdtool references. - Boundary markers: None present in the instructions.
- Capability inventory: UI interaction tools (
fmt_tap_widget, etc.), state evaluation, and CLI permission commands. - Sanitization: None specified.
- This surface is considered a functional requirement for the skill's purpose rather than a malicious vector.
Audit Metadata