flutter-upgrade-creator

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill and its generated output involve the execution of standard development and automation tools including git, gh (GitHub CLI), flutter, dart, fvm, and melos. These are used for branch management, PR creation, and SDK maintenance.
  • [EXTERNAL_DOWNLOADS]: The skill fetches information from official and well-known documentation sites such as flutter.dev, dart.dev, and blog.flutter.dev to gather release notes and breaking change details. These are trusted sources for Flutter development.
  • [DYNAMIC_EXECUTION]: The skill functions as a generator, creating a new SKILL.md file in a specific local directory (/Users/mono/Git/skills/) based on a template. This is the primary intended purpose of the meta-skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites (official release notes) to populate the generated skill.
  • Ingestion points: Data enters the context via read_url_content and search_web targeting external release documentation.
  • Boundary markers: The generated template does not explicitly include boundary markers for the external content it summarizes.
  • Capability inventory: The generated skill possesses capabilities to write to the filesystem, execute shell commands (git, flutter), and perform network operations via the GitHub CLI.
  • Sanitization: There is no explicit sanitization step for the text extracted from documentation before it is written to the new skill file.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 07:20 AM
Security Audit — agent-trust-hub — flutter-upgrade-creator