The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes standard development tools and local scripts to perform release gates.
Evidence includes the use of flutter analyze, flutter test, dart format, and pod install.
The skill also invokes a local script scripts/collect_flutter_logs.sh for the purpose of checking for hardcoded secrets (e.g., API keys, private keys).
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from the project being analyzed.
Ingestion points: pubspec.yaml, CHANGELOG.md, and project source files in the lib/ directory (analyzed via grep).
Boundary markers: No specific delimiters or boundary warnings are used when processing this data.
Capability inventory: The skill can execute shell scripts, build commands (flutter build), and file formatting tools.
Sanitization: No explicit sanitization or filtering of the ingested file content is mentioned before it is processed by the agent.
[SAFE]: The skill incorporates several security best practices intended to protect the user's project.
It explicitly instructs the agent to check that sensitive files like .env, google-services.json, and GoogleService-Info.plist are listed in .gitignore to prevent accidental exposure.
It includes a manual secret scanning step using grep to identify common patterns for hardcoded credentials (e.g., AIza, sk-, private_key).
It enforces a rule to never commit signing credentials to source control and requires explicit user approval before executing actual release or publish commands.

flutter-release-readiness