flutter
Fail
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the domain flutterreleases.com in VERSIONS.md as an independent tracker. Automated security scans have identified this domain as blacklisted/malicious.
- [REMOTE_CODE_EXECUTION]: Instructions in AGENT-TOOLING.md, BUILD-AND-RELEASE.md, and TESTING.md guide users to download and execute third-party software using npx, pip3, and dart pub global activate. These commands (e.g., npx skills add, pip3 install codemagic-cli-tools) involve executing remote code from package registries on the local environment.
- [CREDENTIALS_UNSAFE]: In LOCALIZATION.md, the skill provides a command-line template for auto-translation (dart run slang gpt --api-key=sk-...) that encourages users to pass sensitive API keys as plain-text arguments. This practice can lead to the exposure of credentials in shell history files and process monitoring tools.
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for low-level system and device interaction, including adb shell commands for Android device manipulation, keytool for cryptographic keystore generation, and various flutter build and test commands.
Recommendations
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata