flutter-security
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted external data, such as Dart source code and platform configuration files. This creates a potential surface for indirect prompt injection if an attacker embeds malicious instructions within the files being audited.
- Ingestion points: The skill ingests untrusted data from
pubspec.yaml,pubspec.lock, platform manifests (AndroidManifest.xml, Info.plist), and Dart source code files. - Boundary markers: There are no explicit boundary markers or "ignore instructions" delimiters defined in the instructions to protect the agent while it reads external file content.
- Capability inventory: The skill's capabilities include reading files, performing static analysis, and generating security reports. It does not appear to utilize subprocess execution or network operations for its auditing tasks.
- Sanitization: No explicit sanitization, filtering, or escaping of the ingested code or configuration content is mentioned.
Audit Metadata