flutter-best-practices
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to use the
Bashtool to run shell commands for counting and listing project files. Specifically, it usesfindcombined withwc -lto identify Dart source files and test files within the project directory for the purposes of setting the audit scope. - [PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted content from the user's project files, specifically all files matching
**/*.dartand**/*_test.dart. It lacks explicit instructions to use boundary markers or treat the file content strictly as data, creating a surface for indirect prompt injection where adversarial instructions hidden in code comments could influence agent behavior. - Ingestion points: Project source code and test files discovered via
glob_file_searchand shell commands. - Boundary markers: None present in the provided instructions.
- Capability inventory: Access to
Bash,Write,Edit, andWebFetchtools. - Sanitization: No validation or sanitization of the ingested code content is performed before processing.
- [EXTERNAL_DOWNLOADS]: The skill references architectural and testing standards hosted in the vendor's repository on GitHub (
somnio-software/somnio-ai-tools). This is an external reference to documentation used to inform the audit process.
Audit Metadata