skills/pluginagentmarketplace/custom-plugin-flutter/custom-plugin-flutter-skill-database/Gen Agent Trust Hub
custom-plugin-flutter-skill-database
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
SyncEngineclass inSKILL.mddemonstrates a synchronization pattern that fetches data from remote sources usingremote.getUpdates(). This architecture introduces a surface for indirect prompt injection where malicious instructions embedded in remote data could influence the agent's behavior during the merge process. Ingestion points:remote.getUpdates()inSKILL.md. Boundary markers: Absent. Capability inventory: Local database persistence and storage management viathis.local.upsert. Sanitization: No sanitization or validation of the remote data structure is shown in the examples. - [SAFE]: The skill includes legitimate implementations for Hive, SQLite (sqflite), and SharedPreferences. It also demonstrates secure encryption practices using the
encryptpackage with secure random keys. All external service references, such as Firebase Firestore and Supabase, target well-known technology providers. While the metadata description claims '1800+ lines' of code which is inconsistent with the actual content, this appears to be a descriptive discrepancy rather than a malicious obfuscation attempt.
Audit Metadata