The Agent Skills Directory

[SAFE]: The skill provides a legitimate utility for Flutter developers using FVM (Flutter Version Management). The scripts automate complex tasks like manual IPA codesigning and multi-platform uploads using standard, reputable tools such as xcodebuild, fastlane, and iTMSTransporter.
[COMMAND_EXECUTION]: The skill's scripts (fvm_android_upload.sh, fvm_ios_upload.sh) execute local commands within the user's project environment. Analysis shows that variables representing file paths and build targets are correctly quoted to prevent argument or path injection. The use of chmod +x is restricted to the skill's own scripts to enable their execution.
[CREDENTIALS_UNSAFE]: The skill correctly manages sensitive information (e.g., Apple API keys, distribution certificates) by instructing the user to set them as environment variables. This avoids the risk of hardcoding secrets in the project files or scripts themselves.
[PROMPT_INJECTION]: A potential surface for indirect prompt injection exists where the skill reads pubspec.yaml using grep to determine SDK version requirements. However, the extracted data is used solely for version comparison logic and is not interpolated into executable strings or sensitive agent instructions.
Ingestion points: pubspec.yaml (read by grep in SKILL.md).
Boundary markers: None present.
Capability inventory: Subprocess execution of fvm, flutter, xcodebuild, and fastlane across all scripts.
Sanitization: No specific sanitization of the pubspec.yaml content is performed before being presented to the agent, but the scope of use is limited to version identification.

fvm-flutter-release