flutter-testing
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to review and interact with existing Flutter test code, which presents a surface for indirect prompt injection where instructions embedded in project files could influence agent behavior.
- Ingestion points: The skill reviews unit, widget, and integration tests as part of its core functionality in
SKILL.md. - Boundary markers: The instructions lack specific delimiters or warnings to ignore instructions embedded within the code files being analyzed.
- Capability inventory: The skill can execute shell commands via the Flutter test runner and perform file system operations (create/delete) as documented in the "Disposable test probes" section.
- Sanitization: There are no explicit steps to sanitize or validate the content of reviewed test files before they are processed or executed.
- [DYNAMIC_EXECUTION]: The skill generates and executes Dart source files at runtime for diagnostic purposes.
- Evidence: The "Disposable test probes" section in
SKILL.mdand theevals/cases.jsonfile explicitly instruct the agent to create temporary*_test.dartfiles and run them. - [COMMAND_EXECUTION]: The skill relies on executing host-side commands to perform testing and cleanup tasks.
- Evidence: The verification section in
SKILL.mdinstructs the use of the repository's established test command or MCP capabilities. The lifecycle management for disposable probes involves host-side file creation and deletion commands.
Audit Metadata