flutter-build-release
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation consistently promotes security best practices for mobile application development. It emphasizes the importance of reproducible builds and environment-specific configurations while maintaining strict boundaries around sensitive data.
- [CREDENTIALS_UNSAFE]: Multiple files (SKILL.md, flavor-and-scheme-alignment.md) explicitly prohibit the printing or committing of secrets, keystores, provisioning profiles, or service credentials to source control. It correctly recommends using .gitignore for local properties and secure environment variables for CI/CD environments.
- [OBFUSCATION]: The skill provides guidance on using standard Flutter obfuscation flags (
--obfuscateand--split-debug-info) for code hardening. It includes a specific threat model section clarifying that obfuscation is not encryption and should not be relied upon to protect hardcoded secrets, which is an important security distinction. - [COMMAND_EXECUTION]: The command-line examples provided are standard Flutter CLI operations for building artifacts and symbolicating stack traces. No evidence of unauthorized command execution, privilege escalation, or malicious shell injection was found.
- [INDIRECT_PROMPT_INJECTION]: While the skill interacts with project configuration files (like pubspec.yaml), it includes specific preflight rules and verification steps to ensure the agent follows existing repository policies and does not introduce unauthorized changes.
Audit Metadata