flutter-mobile-development
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to ingest and analyze external data from the project repository, which constitutes an attack surface for indirect prompt injection. Maliciously crafted instructions embedded in code comments or configuration files could potentially subvert the agent's intent.
- Ingestion points: The skill explicitly directs the agent to read pubspec.yaml, analysis_options.yaml, and files within the lib/ and test/ directories (referenced in the Discovery section).
- Boundary markers: There are no defined boundary markers or system-level instructions provided within the skill to distinguish between the agent's core instructions and the content of the files being analyzed.
- Capability inventory: The agent is authorized to modify the file system and execute development tools such as flutter analyze, flutter test, and dart format (referenced in the Testing and validation section).
- Sanitization: The skill does not prescribe any sanitization, validation, or escaping techniques for the content it reads from the repository before that content is incorporated into the agent's context.
Audit Metadata