flutter-testing-skill

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use standard Flutter and Dart CLI tools for development and testing.
  • Evidence: Commands include flutter test, flutter build apk, flutter build ios, and dart run build_runner build for code generation. These are standard operations within the Flutter development lifecycle.
  • [EXTERNAL_DOWNLOADS]: The skill provides documentation for uploading compiled application artifacts to the LambdaTest cloud platform for automated testing on real devices.
  • Evidence: The curl command targets manual-api.lambdatest.com/app/upload/realDevice. This is a vendor-controlled API endpoint used for its intended service functionality. Authentication is handled correctly via environment variables ($LT_USERNAME, $LT_ACCESS_KEY) rather than hardcoded credentials.
  • [INDIRECT_PROMPT_INJECTION]: The skill generates Dart test code based on user-provided descriptions of application components, which constitutes a surface for indirect prompt injection.
  • Evidence:
  • Ingestion points: User descriptions of UI components, business logic, or app behavior provided in the chat context.
  • Boundary markers: None explicitly defined in the provided templates.
  • Capability inventory: The skill facilitates command execution via the flutter CLI and network uploads via curl.
  • Sanitization: No explicit sanitization or validation of the generated code strings is demonstrated in the provided snippets. However, as the primary purpose of the skill is code generation for developer use, this risk is considered inherent to the tool's function.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:34 PM