The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions establish a workflow where the AI agent ingests and processes data from the local project environment, which represents a potential attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read pubspec.yaml and inspect project source code to determine SDK constraints and established coding styles.
Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore potentially malicious instructions embedded within the source code or configuration files it reads.
Capability inventory: The agent has the capability to execute shell commands, specifically the dart run build_runner build command for code generation.
Sanitization: There are no instructions provided for sanitizing or validating the contents of the files read before they are processed or used to generate code.
[SAFE]: All external resource references point to official and trusted domains associated with the Dart and Flutter ecosystems, including dart.dev, flutter.dev, and pub.dev (the official package registry).
[SAFE]: The skill emphasizes best practices for code integrity, such as strictly forbidding the manual editing of generated files and ensuring that changes are verified through static analysis and testing.
[SAFE]: No evidence of obfuscated URLs, hidden instructions, credential exposure, or unauthorized network activity was found within the skill files.

dart-language