flutter-windows-ui-testing
Warn
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes PowerShell's Add-Type command in SKILL.md to compile and execute C# code at runtime. This code interacts with sensitive Win32 APIs from user32.dll and kernel32.dll to manipulate window focus via AttachThreadInput and simulate user input through mouse_event and keybd_event.
- [COMMAND_EXECUTION]: Instructions across both files involve executing local system commands and binaries, such as using taskkill to terminate processes and running the whisper-cli.exe executable from the application's build directory.
- [DATA_EXFILTRATION]: The skill implements a screenshot capability in SKILL.md using the System.Drawing.Graphics.CopyFromScreen method. This allows the agent to capture visual data from the user's desktop and save it to the local file system, which constitutes a data exposure risk.
- [PROMPT_INJECTION]: The speech-to-text testing workflow in whisper-stt-testing.md processes transcription output from whisper-cli.exe. This creates an indirect prompt injection surface where untrusted data enters the agent context via the whisper-cli output. There are no boundary markers or instructions to ignore embedded commands. The skill possesses significant capabilities including Win32 UI control and subprocess execution. No security sanitization or filtering is performed on the external audio transcription before it is processed.
Audit Metadata