flutter-use-http-package
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructs users to add the official 'http' package via 'flutter pub add http' and configure standard internet permissions for Android and macOS. These are required for the skill's stated purpose of networking.
- [SAFE]: The example code contains a placeholder for an authentication token ('Bearer token_here'), which does not represent a sensitive credential exposure.
- [INDIRECT_PROMPT_INJECTION]: The skill implements logic to process data from an external API endpoint ('https://api.example.com/products'). While this introduces a surface for indirect prompt injection if the endpoint is compromised, the risk is minimized by the skill's use of strict model mapping and standard JSON decoding. • Ingestion points: The 'fetchProducts' method in 'SKILL.md' ingests the body of an HTTP response. • Boundary markers: No explicit instructions are provided to the model to ignore instructions within the data. • Capability inventory: The skill allows network GET operations but does not include file system writes or command execution based on the ingested data. • Sanitization: The skill uses 'jsonDecode' and maps the result to a typed 'Product' model using a factory constructor ('Product.fromJson'), which acts as a validation layer.
Audit Metadata