The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit instructions for the agent to execute shell commands, such as using sed to modify pubspec.yaml files and running flutter pub get. It also recommends using adb shell and xcrun simctl for low-level system input injection.
[REMOTE_CODE_EXECUTION]: The integrated Mobile MCP toolset includes mobile_install_app, which allows for the installation of arbitrary application packages (APK, IPA, APP) onto a target device. The skill also facilitates executing arbitrary code through run_tests and custom VM extension calls via call_custom_extension.
[DATA_EXFILTRATION]: The skill enables full screen capture and recording capabilities (mobile_take_screenshot, mobile_start_screen_recording). A workflow example in the documentation specifically highlights capturing an "OTP page," which poses a risk of exposing sensitive authentication information if handled by the agent.
[EXTERNAL_DOWNLOADS]: The skill interacts with the external pub.dev package registry for dependency management and search. It also includes the mobile_open_url tool, which can be configured via environment variables to bypass safety checks for deep link URL schemes.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from application UI elements and accessibility trees (via mobile_list_elements_on_screen and get_widget_tree) and passes it to powerful tools like mobile_click, mobile_install_app, and shell command execution.
Ingestion points: UI element lists and widget tree data from target applications (SKILL.md).
Boundary markers: None identified in the provided instructions.
Capability inventory: File modification (sed), package installation (pub), app installation (mobile_install_app), and UI automation (Mobile/Marionette MCP).
Sanitization: No sanitization or validation of the ingested UI data is mentioned before it influences agent actions.

flutter-mcp-testing