flutter-init
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface where user-provided input is used to construct shell commands, creating a command injection risk.
- Ingestion points: User-provided values for '폴더명' (folder name), '프로젝트명' (project name), '조직명' (organization name), and '엔티티명' (entity name) in
SKILL.mdSteps 1 and 2. - Boundary markers: None provided to delimit user input from shell command structures.
- Capability inventory: Execution of
flutter create,flutter pub get, anddart run build_runnervia the agent's shell capabilities. - Sanitization: No specific sanitization or validation logic is defined to prevent the use of shell control characters (e.g.,
;,&&,|) in the input fields. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute multiple shell commands (
flutter create,dart run build_runner,flutter analyze) to set up the development environment. While these are standard developer operations, the execution flow depends on non-validated user inputs.
Audit Metadata