The Agent Skills Directory

[SAFE]: The skill focuses on UI implementation and state management for Flutter applications using the well-known pinput package. No malicious patterns such as prompt injection, unauthorized data exfiltration, or obfuscation were detected.
[SECURITY_BEST_PRACTICES]: The documentation proactively addresses security concerns in the 'Security and Sensitive Data' section. It instructs the agent to enable masking for sensitive inputs (shoulder-surfing defense), disable IME personalized learning to prevent OS-level keyboard caching of PINs, and strictly forbids logging sensitive codes to console or analytics tools.
[EXTERNAL_DOWNLOADS]: The skill references standard, community-accepted Flutter packages (pinput, smart_auth) and links to official documentation on pub.dev, GitHub (Tkko/Flutter_PinPut), and Google Developers. These references are used appropriately to define the 'Source of Truth' and do not involve untrusted or risky remote code execution.
[INDIRECT_PROMPT_INJECTION]: While the skill handles external data (SMS codes and user input), it mitigates risks by recommending FilteringTextInputFormatter.digitsOnly to ensure only numeric data is processed. It provides structured validation and submission patterns that follow the principle of least privilege for the agent's capabilities.

flutter-pinput