The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes project files, including Dart source code and native configuration files, which establishes a surface for indirect prompt injection. This is an inherent part of the security auditing process, and the risk is mitigated by the skill's limited capabilities, which are restricted to local searching and report generation. 1. Ingestion points: Source code in lib/, asset folders, and native platform directories (android/, ios/). 2. Boundary markers: No specific delimiters are used to separate untrusted code content from agent instructions during the audit process. 3. Capability inventory: The skill is restricted to reading file contents via search commands and writing findings to a local markdown document. 4. Sanitization: No explicit sanitization of the processed content is mentioned.
[COMMAND_EXECUTION]: The skill utilizes grep commands to scan the project directory for sensitive patterns such as API keys and private tokens. This is a standard and safe use of shell tools for the intended purpose of a security audit.

flutter-security