flutter-app-hardening-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to analyze local repository files such as pubspec.yaml and AndroidManifest.xml. This creates a surface where malicious content embedded in project files could attempt to influence agent behavior.
- Ingestion points: SKILL.md workflow step 1 requires inspection of repository dependencies and build scripts.
- Boundary markers: Lacks explicit prompt-level delimiters to ignore embedded instructions in analyzed files.
- Capability inventory: The agent modifies code and executes build commands.
- Sanitization: No sanitization defined for data ingested during repository audits.
- [EXTERNAL_DOWNLOADS]: The skill references official security documentation from trusted sources like Google, Apple, and the Flutter team. These references are documented neutrally as they are well-known, legitimate services.
Audit Metadata