custom-plugin-flutter-skill-performance

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill instructions focus strictly on Flutter performance optimization techniques and do not contain any instructions attempting to override agent behavior, bypass safety filters, or extract system prompts.
  • [DATA_EXPOSURE]: No hardcoded credentials, sensitive file paths, or network operations targeting non-whitelisted domains were found. The code examples use benign placeholder URLs.
  • [OBFUSCATION]: Analysis of the markdown and code files revealed no evidence of hidden content, multi-layer encoding, zero-width characters, or homoglyph-based attacks.
  • [REMOTE_CODE_EXECUTION]: There are no patterns involving the download and execution of remote scripts. The included Python script (scripts/perf_analyzer.py) is a simple metadata reporter with no external dependencies.
  • [COMMAND_EXECUTION]: The shell commands mentioned in SKILL.md are standard Flutter build and analysis commands (e.g., flutter build apk --analyze-size) intended for local development workflows.
  • [PRIVILEGE_ESCALATION]: No commands for acquiring elevated permissions (such as sudo or registry modifications) were detected.
  • [METADATA_POISONING]: The skill description claims to contain "1600+ lines" of mastery, which is hyperbolic given the actual file sizes. However, this is a minor metadata inconsistency and does not pose a security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 12:37 PM