syncfusion-flutter-signature-pad
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the syncfusion_flutter_signaturepad package, which is a legitimate library from a known vendor, retrieved via the official Flutter package manager.
- [COMMAND_EXECUTION]: The documentation includes standard development commands for adding dependencies to a Flutter project (flutter pub add).
- [DATA_EXFILTRATION]: The skill demonstrates how to export captured signatures and transmit them to external services. The provided code examples use generic placeholders for API endpoints (e.g., api.example.com) and follow standard practices for handling user-generated content.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user drawing input via the SfSignaturePad widget (ingestion point). While it lacks explicit text boundary markers, it demonstrates a capability inventory including image conversion (toImage) and file writing (writeAsBytes). The documentation provides sanitization patterns by implementing stroke count and drawing duration validation before data processing.
Audit Metadata