The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it analyzes external project files and has shell execution capabilities. \n
Ingestion points: The agent reads project files like pubspec.yaml and files within the test/, integration_test/, and test_driver/ directories as specified in the workflow section of SKILL.md. \n
Boundary markers: The instructions lack specific markers or delimiters to help the agent distinguish untrusted project data from its own internal instructions. \n
Capability inventory: The skill allows for the execution of multiple shell commands such as flutter test, dart run build_runner build, flutter drive, and a local validation script bash scripts/verify-examples.sh. \n
Sanitization: There is no mention of sanitizing, escaping, or validating the content ingested from external project files before it is processed by the agent.\n- [COMMAND_EXECUTION]: Core functionality of the skill involves the execution of various shell commands. The Mandatory Validation section of SKILL.md instructs the agent to run commands including flutter test, dart run build_runner build, and bash flutter-testing/scripts/verify-examples.sh to verify changes and test implementations.\n- [DYNAMIC_EXECUTION]: The skill includes a maintenance script, scripts/verify-examples.sh, that utilizes dynamic code execution. The script uses ruby -e to execute Ruby logic for parsing YAML frontmatter and checking for broken links within the skill's markdown files.

flutter-testing