publish-flutter-package

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill parses and acts on user-generated repository content—specifically reading .github/workflows via scripts/inspect_workflows.py and commit messages/git history via scripts/prepare_release.py (and SKILL.md instructs to "proceed with the suggested values" if the user skips)—so untrusted workflow files and commit text from the repo can be ingested and materially influence tagging/publishing decisions.