dart-dedupe
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Dart source code files provided in the target_path. This represents an attack surface where instructions hidden in code comments or data could influence the agent's behavior. * Ingestion points: Dart source files within the repository targeted for deduplication. * Boundary markers: The skill explicitly requires the creation of a dedupe_triage_report.md artifact and a mandatory human-in-the-loop confirmation gate before any refactoring actions are taken. * Capability inventory: The skill has capabilities to execute shell commands (dart run, dart test, git add) and modify source code files. * Sanitization: Relies on manual triage and user verification rather than automated sanitization of the code content.
- [EXTERNAL_DOWNLOADS]: The skill invokes dart run dedupe@^0.1.0, which fetches the package from pub.dev, the official and well-known registry for Dart and Flutter packages. This behavior is expected and aligns with the tool's primary purpose.
Audit Metadata