marionette-flutter-to-patrol
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes session data from external files (
steps.md,report.md) located in the.marionette/sessions/directory to generate test code. This represents an attack surface where malicious instructions embedded in session logs could influence agent behavior. - Ingestion points: The skill reads transcript and summary data from
steps.mdandreport.mdin the session directory. - Boundary markers: No specific delimiters or safety instructions are defined for processing these files.
- Capability inventory: The skill is capable of generating and writing Flutter Dart code to the filesystem and interacting with the Patrol testing framework.
- Sanitization: There is no mention of sanitizing or validating the input data from the session files before using it to reason about or generate code.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing external dependencies and plugins from the author's own repositories and packages.
- Author resources: Recommends installing additional skills from the
leancodepl/patrol/skillsrepository using thenpx skillsCLI. - Dependency retrieval: Suggests fetching the
patrol-write-testandpatrol-test-architectureskills usingdart run skills@ get -p patrol. - Plugin installation: Directs the user to install the
flutter-patrol@leancode-ai-pluginsplugin in Claude Code. - [DYNAMIC_EXECUTION]: The primary purpose of the skill is to generate executable Dart test scripts based on the logic extracted from session logs.
- Code generation: Translates session steps into functional Patrol test code (e.g.,
$(keys.page.widget).tap(),$.tester.sendKeyEvent).
Audit Metadata