flutter-testing-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard Flutter and Dart CLI tools for development and testing.
- Evidence: Commands include
flutter test,flutter build apk,flutter build ios, anddart run build_runner buildfor code generation. These are standard operations within the Flutter development lifecycle. - [EXTERNAL_DOWNLOADS]: The skill provides documentation for uploading compiled application artifacts to the LambdaTest cloud platform for automated testing on real devices.
- Evidence: The
curlcommand targetsmanual-api.lambdatest.com/app/upload/realDevice. This is a vendor-controlled API endpoint used for its intended service functionality. Authentication is handled correctly via environment variables ($LT_USERNAME,$LT_ACCESS_KEY) rather than hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill generates Dart test code based on user-provided descriptions of application components, which constitutes a surface for indirect prompt injection.
- Evidence:
- Ingestion points: User descriptions of UI components, business logic, or app behavior provided in the chat context.
- Boundary markers: None explicitly defined in the provided templates.
- Capability inventory: The skill facilitates command execution via the
flutterCLI and network uploads viacurl. - Sanitization: No explicit sanitization or validation of the generated code strings is demonstrated in the provided snippets. However, as the primary purpose of the skill is code generation for developer use, this risk is considered inherent to the tool's function.
Audit Metadata