flutter-native-splash-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing standard development commands related to the flutter_native_splash package.
- Evidence: Mentions of
dart run flutter_native_splash:createanddart run flutter_native_splash:removefor resource generation and cleanup. - Evidence: A search command using
rg(ripgrep) is suggested for navigating the bundled production guide. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process local project files which serves as a potential ingestion surface for untrusted data if used in a malicious environment.
- Ingestion points: Reads and audits
pubspec.yaml,pubspec.lock, and various YAML splash configuration files (referenced inSKILL.mdandproduction-guide.md). - Boundary markers: None explicitly mentioned in the instructions for data ingestion.
- Capability inventory: The skill utilizes shell command execution via the Flutter/Dart toolchain and performs modifications to native Android, iOS, and Web resource files.
- Sanitization: No explicit sanitization of input file content is mentioned, relying on the underlying
flutter_native_splashpackage logic. - Note: This is an inherent surface for developer tools and is considered acceptable within the context of the skill's primary purpose.
Audit Metadata