pub-package-explorer
Pass
Audited by Gen Agent Trust Hub on Mar 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches package source code from the official pub.dev registry using the
dart pub unpackcommand. This is a standard development operation for exploring package implementations from a well-known, trusted repository.- [COMMAND_EXECUTION]: Employs common CLI utilities likejq,sed,find,ls, andrgto resolve local file paths from.dart_tool/package_config.jsonand search through source code directories.- [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by reading and displaying source code from external packages. - Ingestion points: Source code is read from local filesystem paths and directories created by
dart pub unpackas defined inSKILL.md. - Boundary markers: No specific boundary markers or instructions to ignore embedded instructions are provided when the agent reads external code.
- Capability inventory: The agent uses
ls,rg, andcatto navigate and read file contents. - Sanitization: No sanitization or validation is applied to the package content before it is processed by the agent.
Audit Metadata