using-remix
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'remix' and 'remix_cli' packages via the standard Flutter package manager (pub). It also manages design system components by fetching them from GitHub registries, which are typically pinned to specific commit SHAs for integrity. All referenced external resources are under the vendor's ('btwld') infrastructure or well-known services.
- [COMMAND_EXECUTION]: The skill provides instructions for using the 'remix_cli' tool to initialize projects ('remix init') and add components ('remix add'). These commands are standard for modern component-based design systems and are executed within the user's project environment.
- [REMOTE_CODE_EXECUTION]: Documentation includes instructions for running Dart scripts to generate theme palettes ('generate.dart') and using the 'build_runner' package for Dart code generation. These operations are standard practices in the Flutter development ecosystem and are initiated by the developer as part of the build process.
- [DYNAMIC_EXECUTION]: The skill utilizes Dart's 'build_runner' to generate adapter files ('.g.dart') based on annotations and component recipes. This is a common and expected practice in Flutter development for boilerplate reduction.
- [INDIRECT_PROMPT_INJECTION]: As a code generation assistant, the skill has an inherent surface for indirect prompt injection via user-supplied UI requirements.
- Ingestion points: User prompts requesting the creation or modification of Flutter UI components (e.g., requirements for a settings page or custom buttons).
- Boundary markers: The skill does not explicitly define delimiters for user input, relying on the underlying agent's prompt handling and safety guardrails.
- Capability inventory: The skill uses file-writing operations via code generation and CLI tool execution for environment setup.
- Sanitization: Input is processed to generate structured Dart code, but no explicit sanitization of text-based UI requirements is described within the skill instructions.
Audit Metadata