flutter-verification

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and verify output from various CLI tools, which could potentially be manipulated by malicious code within the project being analyzed.
  • Ingestion points: Command output from flutter analyze, flutter test, and flutter build (SKILL.md).
  • Boundary markers: None; the agent relies on raw terminal output to validate its own work.
  • Capability inventory: Command execution via flutter, dart, node, and npx (SKILL.md).
  • Sanitization: No explicit instructions for sanitizing or escaping tool output before processing.
  • [DYNAMIC_EXECUTION]: The skill executes a local script (capture.cjs) using a computed path to a plugin directory.
  • Evidence: node <design-polish-path>/scripts/capture.cjs --wcag / (SKILL.md).
  • [COMMAND_EXECUTION]: The skill manages a local web server by starting a background process and later terminating it using a process ID.
  • Evidence: npx serve build/web -l 3000 & and kill $SERVER_PID (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 11:51 AM