The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill addresses the inherent attack surface of embedding untrusted web content. It implements multiple defensive layers, including strict URI normalization (rejecting string prefix checks), Dart-side validation of JavaScript bridge messages, and origin-based permission scoping. Mandatory Evidence Chain: 1. Ingestion points: WebView renderer, JavaScript bridge channels (javascript-bridges-and-permissions.md), and file chooser inputs (sessions-files-and-lifecycle.md). 2. Boundary markers: Explicit instructions to use parsed URI components and bounded JSON message contracts. 3. Capability inventory: Navigation control, JavaScript execution, cookie/session management, and file system interaction (downloads/uploads). 4. Sanitization: Mandates Dart-side validation of every payload, host normalization, and rejection of insecure protocols (HTTPS enforcement).
[EXTERNAL_DOWNLOADS]: The skill references technical documentation and official resources from trusted platforms including pub.dev, docs.flutter.dev, developer.android.com, and developer.apple.com to guide implementation.
[COMMAND_EXECUTION]: The skill manages interactions with platform-native capabilities such as the camera, microphone, and file system (via file choosers and downloads). It ensures security by requiring explicit user-visible actions, platform permission checks, and validation of any content returned from the system to the application context.

flutter-webview