The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions intended to secure the agent against prompt injection attacks. Specifically, the instruction in REVIEW.md to ignore directives like 'ignore previous instructions' found in analyzed files is a defensive security measure rather than a malicious attempt to override safety guidelines. The role-playing instruction that designates the agent as a 'Senior Flutter Design Engineer' is necessary for its primary functionality and is accompanied by strict operational constraints that prevent the agent from performing unauthorized actions.
[INDIRECT_PROMPT_INJECTION]: The skill handles third-party project files during its review workflow, creating a surface for indirect prompt injection. Mandatory Evidence Chain: (1) Ingestion points: Flutter project files including Dart source code, YAML configurations, and index.html files read during the audit phase. (2) Boundary markers: Explicit instructions in REVIEW.md requiring the agent to treat all read content as data and to never follow instructions found within project files. (3) Capability inventory: The agent is limited to read-only analysis and printing findings; it is explicitly forbidden from running mutating commands or modifying source code. (4) Sanitization: The skill relies on behavioral instructions to treat input as data rather than technical string sanitization. These controls effectively mitigate the risk, leading to a safe assessment.
[EXTERNAL_DOWNLOADS]: The skill references and provides implementation guides for several well-known and standard Flutter packages including intl, share_plus, permission_handler, and image_picker. These are standard dependencies in the Flutter development ecosystem and do not represent a security threat.

flutter-ux