flutter-dart-package-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows established Flutter/Dart package engineering standards. It emphasizes manual verification and explicitly forbids the agent from performing high-risk actions like publishing or retracting packages without direct user authorization (SKILL.md §8).
- [SAFE]: All tool usage and commands (e.g.,
dart analyze,flutter test,pana) are restricted to standard, official SDK utilities. The skill does not instruct the agent to download or execute code from untrusted external sources. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to analyze project metadata and documentation (e.g.,
pubspec.yaml,README.md). However, this is inherent to its primary purpose of package engineering and is mitigated by the structured workflow and the requirement for user confirmation for all critical actions. - Ingestion points: SKILL.md §2 identifies project files like
pubspec.yaml,README.md, and CI workflows as primary inputs. - Boundary markers: The skill relies on structured technical analysis and checklists rather than natural language instruction processing for these files.
- Capability inventory: Capabilities are limited to standard SDK tools used for analysis, formatting, and testing.
- Sanitization: The skill focuses on technical metadata and source code structure rather than executing instructions contained within the analyzed files.
Audit Metadata