dart-undead
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard Dart development tools (dart run, dart analyze, dart format, dart test) to perform its primary function of code maintenance. These commands are executed within the project directory to audit and remediate source code.
- [INDIRECT_PROMPT_INJECTION]: As a code analysis tool, the skill ingests Dart source code which constitutes an indirect prompt injection attack surface. 1. Ingestion points: The skill processes all Dart files within the repository scope (lib/, bin/, test/) to build a reachability graph. 2. Boundary markers: The skill implements a mandatory two-stage protocol where analysis results are first written to a triage report (undead_triage_report.md) for user review before any modifications occur. 3. Capability inventory: The skill has the ability to execute shell commands for analysis and testing, write report files, and delete/modify source code declarations. 4. Sanitization: Findings are verified through deterministic static analysis, mandatory user confirmation gates, and post-remediation checks using the Dart analyzer and test suites.
- [EXTERNAL_DOWNLOADS]: The skill fetches the 'undead' package from the official Dart package registry (pub.dev) using the 'dart run' command. This is a standard procedure for utilizing Dart ecosystem tools.
Audit Metadata