flutter-dependency-upgrades
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of project configuration files. * Ingestion points: The skill reads pubspec.yaml, lockfiles, version-manager files, and native build configurations as described in SKILL.md and references/platform-toolchain-migrations.md. * Boundary markers: The instructions include strong defensive boundaries, requiring the agent to review every unexpected lockfile change and inspect API and generated diffs before proceeding. * Capability inventory: The skill utilizes dart pub, flutter pub, and project-specific code generators to modify the project environment. * Sanitization: There is no automated sanitization of package metadata or changelog content; safety relies on agent and user review.
Audit Metadata