release-flutter-web-s3
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto orchestrate the release workflow, executing standard developer tools includinggit,flutter, anddart. These operations are essential for its functionality as a build and deployment automation tool. - [COMMAND_EXECUTION]: The orchestration script (
release_web_s3.py) provides support for optional build hooks (e.g.,PRE_BUILD_CMD,TEST_CMD) configured via local environment files. This is a common pattern in deployment utilities to allow project-specific extensions. - [EXTERNAL_DOWNLOADS]: The skill utilizes the AWS CLI to synchronize build artifacts with S3-compatible storage. All destination endpoints and bucket names are user-defined in a local, git-ignored configuration file.
- [DYNAMIC_EXECUTION]: The
verify_fingerprint_web_build.pyscript usesimportlibto dynamically load a helper module from the skill's own script directory. This is used to share manifest parsing logic and is restricted to the skill's local files. - [CREDENTIALS_UNSAFE]: No hardcoded credentials were detected. The skill provides clear documentation advising users to manage secrets securely using AWS profiles or environment variables, and it automatically updates the project's
.gitignoreto prevent accidental exposure of configuration files. - [PROMPT_INJECTION]: The skill's instructions and metadata do not contain any patterns indicative of prompt injection or attempts to bypass AI safety guardrails.
Audit Metadata