flutter-openapi-client
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill is designed with a strong security posture, specifically addressing risks associated with untrusted third-party API documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges that OpenAPI specifications are untrusted inputs and provides clear boundary markers to prevent the agent from blindly following instructions embedded in the data. These mitigations include strict parsing without execution, network boundaries to prevent SSRF, and credential scoping to prevent exfiltration.
- [REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent never to execute remote JavaScript found in documentation pages, treating it as static text instead.
- [DATA_EXFILTRATION]: The instructions include a strict policy against forwarding sensitive headers like 'Authorization' or cookies across origins when resolving external references.
Audit Metadata