flutter-production-build-release
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze numerous repository files (e.g.,
pubspec.yaml,AndroidManifest.xml,Runner.xcodeproj) to prepare release configurations. This behavior creates an attack surface where malicious content within a repository could influence the agent's behavior or build outcomes.\n - Ingestion points: Processes configuration, manifest, and project files in
android/,ios/,macos/,windows/,linux/, andweb/directories.\n - Boundary markers: While the skill provides structured workflows, it lacks explicit instructions for using delimiters or boundary markers when handling potentially untrusted data from the repository.\n
- Capability inventory: The skill utilizes powerful CLI tools including
flutter build,flutter analyze, and native toolchain commands (e.g.,ldd,notarytool) which can be affected by poisoned configuration data.\n - Sanitization: No specific sanitization or validation steps are outlined for external content (like package names or version strings) before they are passed to shell commands.\n- [EXTERNAL_DOWNLOADS]: The skill references the retrieval of dependencies and toolchain components from official and well-known repositories such as
pub.dev. It also directs users to authoritative documentation from Google, Apple, and Microsoft for platform-specific release requirements.
Audit Metadata