static-security
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted Flutter project files, creating a surface for indirect prompt injection.
- Ingestion points: Project files such as Dart source code and YAML/XML configurations are read using the Read, Glob, and Grep tools.
- Boundary markers: The instructions do not define specific delimiters to isolate analyzed code from agent instructions.
- Capability inventory: The skill does not include any executable scripts; frontmatter permissions are restricted to read-only operations and a license-checking tool.
- Sanitization: No sanitization of the external project content is specified.- [SAFE]: The skill correctly identifies and recommends trusted security tools like Google's osv-scanner and refers to established resources such as OWASP and the OSV database.
Audit Metadata