flutter-production-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides robust security and architecture guidelines for Flutter development, emphasizing official documentation and best practices.
- [CREDENTIALS_SAFE]: Instructions explicitly warn against storing secrets in
.envfiles,--dart-define, or using client-side obfuscation as a security boundary, recommending server-side management for privileged credentials and the use of platform-specific secure storage for local needs (references/architecture-and-data.md). - [DATA_EXPOSURE]: Guidelines mandate redacting credentials, personal payloads, and sensitive identifiers in logs to prevent accidental exposure (references/architecture-and-data.md).
- [INDIRECT_PROMPT_INJECTION]: The skill identifies the attack surface presented by untrusted data (external JSON, deep links, platform responses). It mitigates this by instructing the agent to validate shapes, ranges, and identity at the boundary before narrowing them into trusted types (references/architecture-and-data.md).
- [COMMAND_EXECUTION]: Shell commands used (dart format, flutter analyze, flutter test) are standard Flutter toolchain operations for static analysis and testing within the project context (SKILL.md).
- [EXTERNAL_DOWNLOADS]: The skill references only official documentation from well-known domains (docs.flutter.dev, api.flutter.dev, dart.dev) for research and validation purposes, which are considered safe sources.
Audit Metadata