flutter-svg-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the attack surface associated with ingesting and rendering untrusted SVG markup from network or user-provided sources.
- Ingestion points: The skill explicitly identifies
SvgPicture.network,SvgPicture.string, andSvgPicture.memoryas the primary ingestion points for dynamic SVG data. - Capability inventory: The skill details the rendering pipeline (parsing XML into binary vector graphics) and describes capabilities such as network fetching, theming, and rasterization.
- Boundary markers: The skill recommends implementing boundary controls at the application networking layer, such as origin restriction and content validation.
- Sanitization: The skill provides critical security context by stating that
flutter_svgis not a sanitizer and instructs developers to apply resource limits and validation to untrusted inputs before rendering. - [DATA_EXFILTRATION]: The skill enforces best practices regarding sensitive data handling. It explicitly warns against logging authentication headers, signed URLs, or raw user-provided SVG markup in production diagnostics.
Audit Metadata