flutter-upgrade-creator
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill and its generated output involve the execution of standard development and automation tools including
git,gh(GitHub CLI),flutter,dart,fvm, andmelos. These are used for branch management, PR creation, and SDK maintenance. - [EXTERNAL_DOWNLOADS]: The skill fetches information from official and well-known documentation sites such as
flutter.dev,dart.dev, andblog.flutter.devto gather release notes and breaking change details. These are trusted sources for Flutter development. - [DYNAMIC_EXECUTION]: The skill functions as a generator, creating a new
SKILL.mdfile in a specific local directory (/Users/mono/Git/skills/) based on a template. This is the primary intended purpose of the meta-skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites (official release notes) to populate the generated skill.
- Ingestion points: Data enters the context via
read_url_contentandsearch_webtargeting external release documentation. - Boundary markers: The generated template does not explicitly include boundary markers for the external content it summarizes.
- Capability inventory: The generated skill possesses capabilities to write to the filesystem, execute shell commands (
git,flutter), and perform network operations via the GitHub CLI. - Sanitization: There is no explicit sanitization step for the text extracted from documentation before it is written to the new skill file.
Audit Metadata