flutter-android-build
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configures the Gradle wrapper to download the Gradle distribution from services.gradle.org, a well-known and trusted service for build tooling.
- [EXTERNAL_DOWNLOADS]: The GitHub Actions workflows utilize official and well-known actions including actions/checkout, actions/setup-java, subosito/flutter-action, and actions/upload-artifact for build orchestration.
- [COMMAND_EXECUTION]: The GitHub Actions workflows execute shell commands to build and sign Android applications, including the decoding of binary secrets using the base64 utility.
- [COMMAND_EXECUTION]: The skill instructs the user to disable R8/ProGuard (isMinifyEnabled = false). This is a security configuration choice that prioritizes build stability over binary obfuscation and resource shrinking.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a vulnerability surface where build-time configuration is derived from local files.
- Ingestion points: The android/settings.gradle.kts template reads the flutter.sdk path from local.properties.
- Boundary markers: None present; the script assumes the property value is a valid path.
- Capability inventory: The script uses includeBuild on the provided path, allowing the inclusion of arbitrary Gradle build logic into the project context.
- Sanitization: None; the path is used directly to locate Gradle plugins.
Audit Metadata