release-flutter-web-s3

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to orchestrate the release workflow, executing standard developer tools including git, flutter, and dart. These operations are essential for its functionality as a build and deployment automation tool.
  • [COMMAND_EXECUTION]: The orchestration script (release_web_s3.py) provides support for optional build hooks (e.g., PRE_BUILD_CMD, TEST_CMD) configured via local environment files. This is a common pattern in deployment utilities to allow project-specific extensions.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the AWS CLI to synchronize build artifacts with S3-compatible storage. All destination endpoints and bucket names are user-defined in a local, git-ignored configuration file.
  • [DYNAMIC_EXECUTION]: The verify_fingerprint_web_build.py script uses importlib to dynamically load a helper module from the skill's own script directory. This is used to share manifest parsing logic and is restricted to the skill's local files.
  • [CREDENTIALS_UNSAFE]: No hardcoded credentials were detected. The skill provides clear documentation advising users to manage secrets securely using AWS profiles or environment variables, and it automatically updates the project's .gitignore to prevent accidental exposure of configuration files.
  • [PROMPT_INJECTION]: The skill's instructions and metadata do not contain any patterns indicative of prompt injection or attempts to bypass AI safety guardrails.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 06:07 AM
Security Audit — agent-trust-hub — release-flutter-web-s3