The Agent Skills Directory

[SAFE]: The skill functions as a defensive security framework. It provides authoritative guidance on implementing secure Flutter architectures, including OAuth with PKCE, OS-backed secure storage, and strict input validation.
[INDIRECT_PROMPT_INJECTION]: The skill defines workflows for processing external data such as deep links, API responses, and notification payloads, which represents an indirect injection surface.
Ingestion points: API responses, deep links, QR codes, and notification payloads are identified as untrusted sources in references/03-input-links-webview-web.md.
Boundary markers: The skill provides specific code implementations for enforcing trust boundaries, including the AllowedOrigin validator and the TrustedWebView controller.
Capability inventory: The skill utilizes network capabilities via the Dio package and local file system access via the File API.
Sanitization: It mandates strict schema validation, exact URI component matching (rejecting contains() checks), and SQL parameterization for all external data.
[REMOTE_CODE_EXECUTION]: The skill mentions external packages such as dio, flutter_secure_storage, and webview_flutter. These are well-known, official, or highly-vetted Flutter community packages. The skill explicitly warns against using unreviewed or abandoned packages in references/04-data-plugins-supply-chain.md.
[CREDENTIALS_SAFE]: The skill explicitly prohibits hardcoding secrets and provides examples of how to correctly use environment variables and backend proxies to avoid shipping sensitive keys in the client bundle. Anti-patterns involving secrets in .env files are documented specifically to be rejected.

flutter-application-security-engineering