flutter-version-management
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official FVM installation script from
https://fvm.app/install.sh. - [REMOTE_CODE_EXECUTION]: Executes the downloaded shell script directly via
bash, which is an official installation method provided by the FVM project for Unix environments. - [COMMAND_EXECUTION]: Utilizes system package managers (
brew,choco) and the Dart package manager (dart pub) to install the FVM utility, and executesfvmcommands to manage SDK versions. - [PROMPT_INJECTION]: The skill processes project configuration files, creating a surface for indirect prompt injection.
- Ingestion points: Reads
.fvmrc,pubspec.yaml, and.gitignore. - Boundary markers: Absent.
- Capability inventory: Shell command execution via
fvm,bash, and system package managers. - Sanitization: No explicit validation of file contents (e.g.,
.fvmrc) is performed before they are used in commands or configuration templates.
Audit Metadata