The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits all Dart source files (**/*.dart) and test files (**/*_test.dart) within the project workspace. As these files are untrusted data sources, they could contain malicious instructions embedded in code comments or strings intended to manipulate the auditor agent's behavior.
Ingestion points: Files are discovered and read via glob_file_search and the Read tool in references/testing-quality.md, references/architecture-compliance.md, and references/code-standards.md.
Boundary markers: The instructions lack specific delimiters or guidelines for the LLM to ignore instructions found within the analyzed data, increasing the risk of the agent obeying embedded commands.
Capability inventory: The skill has access to powerful tools including Bash, Write, WebFetch, and the Agent tool for subagent dispatch.
Sanitization: There is no evidence of sanitization or filtering of the content read from source files before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to download Flutter best practice standards from the vendor's official GitHub repository (somnio-software/somnio-ai-tools). This is a legitimate requirement for the skill to access the necessary rules for its audit functions.
[COMMAND_EXECUTION]: The skill executes Bash commands for file discovery (e.g., find to count Dart files) and to calculate the report filename using Git metadata and standard shell utilities. These operations are restricted to project structure discovery and management.

flutter-best-practices