dart-build-cli-app
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines workflows that instruct the agent to execute shell commands using the Dart SDK, such as
dart create,dart run, anddart compile. These commands involve interpolation points (e.g.,<project_name>,<command_name>, and<output_path>) which represent a potential command injection surface if the input is malicious or contains shell metacharacters.- [PROMPT_INJECTION]: The application structure described in the skill handles external data via command-line arguments, creating an indirect prompt injection surface. While this is standard for CLI development, it allows untrusted input to enter the agent's execution context. - Ingestion points: The
main(List<String> args)function andCommandRunnerlogic inSKILL.mdare designed to process external arguments. - Boundary markers: There are no instructions or examples demonstrating the use of delimiters or 'ignore' warnings for the data being processed.
- Capability inventory: The skill utilizes
TestProcess.startwithin integration tests to spawn subprocesses. - Sanitization: The provided examples do not include input validation or sanitization logic to mitigate potential injection attacks.
Audit Metadata