Security audit
Security checks for vulnerabilities and agentic risk
This skill provides ordinary Flutter development guidance, with no evidence of hidden access, data theft, or unauthorized persistence.
Expect the agent to edit your Flutter project and run formatting, code generation, analysis, and tests. Review native permission and entitlement changes. Direct inspection did not substantiate SkillSpector's advisory concerns; the supplied static scan reported no findings.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// BAD: stateful rows lose or swap state on reorder and delete
ListView.builder(itemBuilder: (context, i) => DeviceTile(device: devices[i]));
// GOOD
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Path and query parameters arrive from outside the app via deep links. Parse and validate them; a
malformed ID shows an error screen, never a crash or a privileged action.
- App Links (Android `assetlinks.json`, `autoVerify`) and Universal Links (Associated Domains
entitlement) are platform config. Call out every manifest, `Info.plist` and entitlement change.
- Typed routes with `go_router_builder` are optional; adopt them app-wide or not at all.
### 12. Build config comes from flavors and dart-defines, secrets do not
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- [ ] Controllers, focus nodes, subscriptions and timers disposed or cancelled
- [ ] `ref.watch` in build, `ref.read` in callbacks, side effects in `ref.listen` or `BlocListener`
- [ ] Auth redirect central, guarded against loops; deep link parameters validated
- [ ] No secrets in dart-defines or assets; manifest, plist and entitlement changes called out
- [ ] Platform channels generated with Pigeon; native work off the main thread
- [ ] `flutter analyze` clean with strict lints; `dart format` applied
- [ ] New logic covered by deterministic unit or widget tests; `flutter test` passes
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Native code treats every argument from Dart as untrusted input: validate paths, IDs, lengths.
- Do not expose a generic "run this command" or "read this file path" API to Dart.
- Do not send secrets, tokens or raw device identifiers through channels when an opaque handle works.
- New permissions, `AndroidManifest.xml` entries, `Info.plist` usage strings or entitlements needed by
native code are listed in the MR.