The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs users to use sudo to modify the macOS Application Firewall (socketfilterfw). This privilege escalation is used to allow external connections to local Python binaries, which could introduce system-level security risks if used with untrusted code.
[COMMAND_EXECUTION]: A Gradle build-time hook (gradle.projectsEvaluated) is provided to dynamically modify the contents of AndroidManifest.xml files in dependencies. It uses regular expressions to programmatically delete the package attribute during the build process to resolve plugin compatibility issues.
[COMMAND_EXECUTION]: The provided preflight bash script (scripts/android-preflight.sh) executes file system search and pattern matching operations (find, grep) on the local project directory to verify configuration consistency.
[DATA_EXFILTRATION]: The skill recommends enabling cleartextTrafficPermitted="true" in the application's network security configuration. While intended to facilitate connections to local development servers, this configuration globally allows unencrypted HTTP traffic, increasing the risk of data exposure through man-in-the-middle attacks.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection via the preflight script and Gradle build hook.
Ingestion points: The scripts read from local project files including android/app/build.gradle.kts, pubspec.yaml, and Kotlin source files.
Boundary markers: No boundary markers or instructions to ignore embedded content are present in the scripts processing these files.
Capability inventory: The skill has the capability to execute shell commands (grep, find) and perform file system writes via Gradle (mf.writeText).
Sanitization: Data is processed using regular expressions, but there is no explicit validation or escaping of the file content before it is used in the build process.

flutter-android-build-system