flutter-notifications
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions address the handling of untrusted external data via notification payloads and user interactions.
- Ingestion points: Remote push and local notification payloads are identified as external data sources in SKILL.md and references/remote-push-notifications.md.
- Boundary markers: The instructions require the use of versioned allowlists and validation of typed intents before executing app navigation.
- Capability inventory: The skill manages interactions with the app's navigation, persistence, and data-fetching layers.
- Sanitization: Guidelines explicitly mandate the redaction of secrets, authentication tokens, and sensitive PII from all notification payloads and logs.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and setup guides from established and trusted platforms including Google Firebase, Android Developer, and Apple Developer.
- [SAFE]: The skill follows secure development patterns, emphasizing least privilege and input validation for notification-based triggers.
Audit Metadata