flutter-upgrade-3-50
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project files and tool outputs to drive its logic, which presents an attack surface for instructions embedded in data.\n
- Ingestion points: Processes content from
pubspec.yaml,melos.yaml,.fvmrc, and the output offlutter --versionanddart migrate.\n - Boundary markers: No explicit delimiters are used to isolate or sanitize the data read from these files before it is analyzed by the agent.\n
- Capability inventory: The skill possesses significant capabilities including file system read/write, shell command execution via tools like
flutter,dart,git,gh, andmelos.\n - Sanitization: External content from the project environment is used to update configuration and command arguments without explicit validation or escaping.\n- [COMMAND_EXECUTION]: The workflow relies on the execution of several local development and version control tools.\n
- Evidence: It invokes
flutter upgrade,fvm use,dart migrate,melos bs,dart fix,git commit, andgh pr createas part of its upgrade and reporting process.
Audit Metadata