flutter-gemini-live

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The README.md and installation guides provide a command to download and execute a setup script using curl | bash. The script is hosted on the project's official GitHub repository. In the context of this package, this is a legitimate installation method provided by the author to automate the setup of skill definition files for various AI agents.
  • [EXTERNAL_DOWNLOADS]: The tool/install_skills.sh script downloads skill definition files (SKILL.md) from the author's official repository and places them into local configuration directories for AI coding assistants like Claude, Gemini CLI, and Codex. These downloads are part of the intended installation and discovery process.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests real-time audio from the microphone and visual data from camera frames to interact with the Gemini Live API. As an AI assistant interface with tool-calling capabilities (e.g., calendar reminders, search), this creates an ingestion surface for potential indirect prompt injection from the user's environment. The skill mitigates this through system prompt templates and reliance on the underlying model's safety guardrails.
  • [COMMAND_EXECUTION]: The skill includes automation scripts (install_skills.sh, check_firebase_ai_compat.sh) used for installation and testing. These scripts perform standard operations such as creating directories, copying files, and managing Dart dependencies (flutter pub get).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 04:07 PM