The Agent Skills Directory

[SAFE]: The skill serves as a purely instructional engineering guide for the url_launcher library in Flutter. It does not execute code itself nor does it include malicious dependencies.
[SAFE]: The instructions emphasize strong security boundaries, explicitly advising against placing credentials, session tokens, or secrets in externally launched URLs (SKILL.md Step 12).
[SAFE]: The skill provides robust defensive patterns for URI validation, such as host allowlisting, scheme allowlisting, and the use of the structured Uri class to prevent injection through string concatenation (SKILL.md Step 4 and Step 5).
[SAFE]: References to potentially dangerous schemes like javascript:, data:, or file: are used in the context of anti-patterns or security tests to instruct the agent to reject such destinations unless explicitly reviewed (references/04-testing-debugging-migration.md).
[SAFE]: The skill includes checklists for privacy-safe logging, recommending that raw URIs containing sensitive query parameters never be logged (SKILL.md Step 12).

flutter-url-launcher-engineering