The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process untrusted project data from the audited repository, including README files, pubspec configurations, and GitHub Actions workflows. The instructions do not explicitly mandate the use of boundary markers or sanitization when the agent interpolates this content into its context, creating a surface where a malicious repository could attempt to influence the audit's output or the agent's logic.
[COMMAND_EXECUTION]: To assess project health, the skill executes various shell commands such as fvm flutter test and fvm flutter pub get on the codebase being audited. While these are necessary for calculating coverage and verifying dependencies, they involve executing code from the project under analysis. The skill attempts to mitigate data overflow by piping output through tail.
[EXTERNAL_DOWNLOADS]: The environment setup phase automates the installation of Node.js via Homebrew and FVM via the Dart package manager. These are well-known and reputable developer tools from trusted ecosystems, and their installation is a standard part of the Flutter development workflow.

flutter-health-audit