flutter-genui
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation correctly identifies AI agent payloads as untrusted sources and mandates a security boundary based on a catalog allowlist. It provides implementation examples that ensure unknown widget types are silently rejected rather than executed.
- [SAFE]: The skill uses a declarative function evaluation system (A2UIFunctionEvaluator) which implements a hardcoded allowlist for formatting, validation, and logic. It explicitly warns against and avoids dynamic code execution techniques like 'eval' or dynamic dispatch (Function.apply).
- [SAFE]: URL handling includes mandatory sanitization patterns that restrict protocols to http/https and provide length limits to prevent injection or buffer-related issues.
- [SAFE]: External dependencies referenced in the setup instructions (e.g., from github.com/flutter/genui and github.com/google/A2UI) are from well-known technology organizations and are used according to standard package management practices.
- [SAFE]: No instances of prompt injection, obfuscation, hardcoded credentials, or persistence mechanisms were found in the provided files.
Audit Metadata