flutter-sdk-changelog
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to add 'material_ui' and 'cupertino_ui' to their pubspec.yaml, claiming they are new standalone replacements for the SDK-bundled design libraries. No such official packages exist from the framework vendor, posing a supply chain risk where users might install untrusted third-party packages. It also recommends installing other third-party libraries ('kaisel', 'bloc_signals') as mandatory modern standards.
- [REMOTE_CODE_EXECUTION]: Recommending dependencies on non-official packages for core framework functionality introduces a risk of executing malicious code during package installation or runtime.
- [COMMAND_EXECUTION]: Directs users to execute 'dart fix --apply --code=migrate_design_widgets', which is not a standard toolchain command and could be used to execute arbitrary logic if malicious plugins are present.
- [METADATA_POISONING]: Contains false information regarding framework versions and architecture, presenting speculative or fabricated changes as authoritative reference material to mislead developers.
Recommendations
- AI detected serious security threats
Audit Metadata