flutter-verification
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and verify output from various CLI tools, which could potentially be manipulated by malicious code within the project being analyzed.
- Ingestion points: Command output from
flutter analyze,flutter test, andflutter build(SKILL.md). - Boundary markers: None; the agent relies on raw terminal output to validate its own work.
- Capability inventory: Command execution via
flutter,dart,node, andnpx(SKILL.md). - Sanitization: No explicit instructions for sanitizing or escaping tool output before processing.
- [DYNAMIC_EXECUTION]: The skill executes a local script (
capture.cjs) using a computed path to a plugin directory. - Evidence:
node <design-polish-path>/scripts/capture.cjs --wcag /(SKILL.md). - [COMMAND_EXECUTION]: The skill manages a local web server by starting a background process and later terminating it using a process ID.
- Evidence:
npx serve build/web -l 3000 &andkill $SERVER_PID(SKILL.md).
Audit Metadata