flutter-schema

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  2.0.0

Overview

This appears to be a code-assistance skill whose project reads and Dart scaffold writes fit its development purpose, with no evidence of hidden exfiltration or destructive behavior.

Install if you want a Flutter/Dart helper that may inspect project files and create scaffold code. Before using file-generation steps, ask it to show the planned files and keep changes limited to the intended project directories.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill advertises scaffold and module creation behavior that implies filesystem access, yet it does not declare permissions for file_read and file_write. Undeclared capabilities weaken user consent and platform enforcement because the skill can modify project files without the permission surface being made explicit.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description frames the skill mainly as architecture guidance and review support, but the behavior includes reading pubspec.yaml and writing concrete Dart scaffold files. This mismatch is dangerous because users may invoke what appears to be advisory documentation while unknowingly granting operational access that changes the codebase.

VirusTotal

66/66 vendors flagged this skill as clean.