flutter-apply-architecture-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting untrusted data from external sources through
DataSourcesandItemApiModelinSKILL.md. It provides instructions for the agent to utilize network requests viaDio, local database operations viaisar, and native platform calls viaMethodChannel. The guide does not specify the use of boundary markers or input sanitization when processing this raw external data, creating a potential surface for instructions embedded in data to influence the application's logic. - [DYNAMIC_EXECUTION]: The documentation encourages the use of
dart:ffi(Foreign Function Interface) to call native C/C++ code. This allows for the execution of code outside the safety constraints of the Dart VM, which represents a vector for low-level system interactions if the loaded libraries are not strictly controlled. - [COMMAND_EXECUTION]: The skill recommends using
MethodChannelandEventChannelfor native platform integration. These capabilities allow the Flutter application to invoke native system functions and execute commands on the host operating system, which could be exploited if triggered by unsanitized inputs from remote data sources.
Audit Metadata