marionette-flutter-to-patrol

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes session data from external files (steps.md, report.md) located in the .marionette/sessions/ directory to generate test code. This represents an attack surface where malicious instructions embedded in session logs could influence agent behavior.
  • Ingestion points: The skill reads transcript and summary data from steps.md and report.md in the session directory.
  • Boundary markers: No specific delimiters or safety instructions are defined for processing these files.
  • Capability inventory: The skill is capable of generating and writing Flutter Dart code to the filesystem and interacting with the Patrol testing framework.
  • Sanitization: There is no mention of sanitizing or validating the input data from the session files before using it to reason about or generate code.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing external dependencies and plugins from the author's own repositories and packages.
  • Author resources: Recommends installing additional skills from the leancodepl/patrol/skills repository using the npx skills CLI.
  • Dependency retrieval: Suggests fetching the patrol-write-test and patrol-test-architecture skills using dart run skills@ get -p patrol.
  • Plugin installation: Directs the user to install the flutter-patrol@leancode-ai-plugins plugin in Claude Code.
  • [DYNAMIC_EXECUTION]: The primary purpose of the skill is to generate executable Dart test scripts based on the logic extracted from session logs.
  • Code generation: Translates session steps into functional Patrol test code (e.g., $(keys.page.widget).tap(), $.tester.sendKeyEvent).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 06:06 PM