flutter-expert
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEMETADATA_POISONINGCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill's YAML frontmatter lists 'https://github.com/Jeffallan' as the author, which differs from the platform-identified author 'seltherpython'. This inconsistency in metadata is noted but does not appear to be intentionally deceptive.\n- [COMMAND_EXECUTION]: The core workflow instructs the agent to execute various Flutter CLI commands including
flutter pub get,flutter analyze,flutter test, andflutter run --profile. It also suggests the use offlutter pub global activate devtools. These are standard development operations.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and debug user-provided Dart source code and project configurations. This creates a surface for indirect prompt injection if the user's project files contain malicious instructions aimed at the agent. \n - Ingestion points: User-provided Dart source files and project configuration files (e.g.,
pubspec.yaml) located in the working directory. \n - Boundary markers: None. The skill does not specify the use of delimiters or 'ignore' instructions when processing user code. \n
- Capability inventory: The skill allows the execution of shell commands through the
flutterCLI. \n - Sanitization: None detected.
Audit Metadata