flutter-project-init
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate templates and automated workflows for Flutter project setup with no malicious patterns detected.
- [EXTERNAL_DOWNLOADS]: The skill uses official Dart packages from the public registry (Pub.dev), such as Freezed, Drift, and Riverpod. These are standard community tools and are documented neutrally without alarming language.
- [COMMAND_EXECUTION]: Standard development commands including
flutter create,flutter pub add, anddart run build_runnerare utilized within their intended operational scope to configure the local project environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input for project configuration metadata to generate code, which is a standard surface for template generators. Evidence Chain:
- Ingestion points: Project name, organization, description, and entity names in
SKILL.md. - Boundary markers: None explicitly defined in the provided templates.
- Capability inventory: Command execution for project initialization and dependency management.
- Sanitization: Relies on standard Flutter CLI validation and agent-level variable handling. This functionality is essential to the skill's primary purpose and is assessed as safe.
Audit Metadata