Claude Code, Skill
Flutter Skills
Agent Skills for building, reviewing, testing, and shipping Flutter and Dart apps, informed by real-world projects.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_SHELL_UNDECLARED
Why this grade
- PERMISSION_SHELL_UNDECLARED Medium
Runs shell commands that the manifest or description does not mention.
skills/flutter-device-testing/scripts/run_lifecycle_matrix.py, line 287
completed = subprocess.run(
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
requests shell access. No manifest field names shell or command execution.
PERMISSION_SHELL_UNDECLARED
skills/flutter-device-testing/scripts/run_lifecycle_matrix.py, line 287
completed = subprocess.run(
.github/scripts/run_behavior_evals.py, line 49
commit = subprocess.run(
.github/scripts/run_behavior_evals.py, line 56
status = subprocess.run(
Show more
.github/scripts/run_behavior_evals.py, line 64
branch = subprocess.run(
.github/scripts/run_behavior_evals.py, line 524
completed = subprocess.run(
.github/scripts/run_behavior_evals.py, line 550
completed = subprocess.run(
.github/scripts/run_behavior_evals.py, line 588
completed = subprocess.run(
.github/scripts/run_behavior_evals.py, line 634
completed = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
.github/scripts/audit_source_freshness.py, line 54
with urllib.request.urlopen(request, timeout=timeout) as response:
.github/scripts/audit_source_freshness.py, line 75
with urllib.request.urlopen(get_request, timeout=timeout) as response:
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
benchmarks/v0.3.0/codex-default-initial.json, line 162
"response": "Please send the Flutter AI coding skill\u2019s GitHub URL or package name; it isn\u2019t included here.\n\nI\u2019ll configure it without exposing credentials:\n\n- Ad
benchmarks/v0.3.0/codex-default.json, line 162
"response": "Please send the Flutter AI coding skill\u2019s GitHub URL or package name\u2014I can\u2019t identify \u201cthis skill\u201d from the request alone.\n\nI\u2019ll config
benchmarks/v0.3.0/codex-default.json, line 174
"evidence": "It explicitly plans to add `OPENAI_API_KEY=` to `.env.example` and configure secret loading before establishing any application requirement."
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 5b89c05fcd81. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 5b89c05fcd817d284a97e970e410a9b806a29d40
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.