The Agent Skills Directory

The skill 'flutter-development' is a documentation-style skill that provides code examples for building Flutter applications. The analysis covered all aspects of the provided SKILL.md file.

Obfuscation: No obfuscation techniques (Base64, zero-width characters, homoglyphs, URL/hex/HTML encoding) were detected in the skill's content or metadata.
Threat Detection:
- Prompt Injection: No patterns indicative of prompt injection (e.g., 'IMPORTANT: Ignore', 'Override', 'jailbreak' instructions) were found.
- Data Exfiltration: The Dart code examples include network requests to https://api.example.com/users/$userId and https://api.example.com/items. These are standard placeholder URLs (example.com) used in documentation and are not real targets for data exfiltration. No sensitive file paths were accessed or referenced.
- Unverifiable Dependencies: The pubspec.yaml section lists common Flutter packages (provider, http, go_router). However, the skill itself does not execute any commands to install these dependencies; it merely presents them as part of the example code. Therefore, this does not constitute an 'unverifiable dependency' threat from the skill's execution perspective.
- Privilege Escalation: No commands or instructions for privilege escalation (e.g., sudo, chmod 777, service installation) were found.
- Persistence Mechanisms: No attempts to establish persistence (e.g., modifying .bashrc, crontab, authorized_keys) were detected.
- Metadata Poisoning: The skill's name and description are benign and accurately reflect its purpose. No malicious instructions were found in the metadata.
- Indirect Prompt Injection: The skill provides code examples and does not process external user input in a way that would lead to indirect prompt injection into the AI.
- Time-Delayed / Conditional Attacks: No conditional logic designed to trigger malicious behavior based on time, usage, or environment was found.
Adversarial Reasoning: Applying an 'assume-malicious' mindset, no hidden or sophisticated evasion techniques were identified. The content is straightforward and aligns with its stated educational purpose.

Conclusion: The skill is deemed SAFE as it is purely instructional and does not contain any active threats or malicious code for the AI to execute. The code provided is for demonstration purposes for a human developer.