flutter-production-logging
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides comprehensive guidelines for secure production logging, explicitly prohibiting the logging of sensitive information such as credentials, tokens, and private keys as stated in Operating Rule 8.
- [SAFE]: The architecture mandates a centralized sanitization boundary that precedes all output sinks including console, file, and remote transport, ensuring that exceptions and network metadata are scrubbed of sensitive data per Workflow Step 6.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for processing application-generated logs and error strings which serve as ingestion points for untrusted data. It addresses this risk by prescribing a central sanitization boundary (boundary marker) and structured event contracts. The capability inventory includes logging to developer consoles, local files, and remote diagnostics sinks. Sanitization is implemented via explicit redaction of passwords, tokens, and allowlisting of safe fields.
- [EXTERNAL_DOWNLOADS]: The skill references various official platform documentation and well-known services including Google (Flutter/Android), Apple, Microsoft, and OpenTelemetry to establish a research-backed baseline for its logging strategies, which are treated as safe under established trust rules.
Audit Metadata