Security Audit
Perform a practical security audit for Flutter/Dart projects, including secrets scanning and prioritized remediation guidance.
Install
$ agentstack add skill-wreos-flutter-cursor-plugin-security-audit ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-wreos-flutter-cursor-plugin-security-audit) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Security Audit
Use this skill for /security-review style checks.
Every code review must include this security pass.
Workflow
- Require explicit target scope (pending diff, PR range, or file set). If missing, request it first.
- Start diff-aware: review pending changes first, then expand to dependent context.
- Run repository-level secrets checks.
- Review code for high-risk patterns:
- hardcoded credentials/tokens/keys
- insecure storage or logging of sensitive data
- missing TLS/certificate validation controls
- unsafe deserialization / dynamic execution patterns
- insufficient authz/authn checks in app/service boundaries
- Review mobile-specific concerns:
- Android/iOS configuration leaks
- debug flags/logging in release paths
- weak handling of deep links/intent data
- Apply false-positive filtering (remove low-impact/no-exploitability noise).
- Classify findings by severity and exploitability.
- Provide minimal safe fixes and validation steps.
OWASP MASVS coverage (required)
- MASVS-ARCH
- MASVS-STORAGE
- MASVS-CRYPTO
- MASVS-AUTH
- MASVS-NETWORK
- MASVS-PLATFORM
- MASVS-CODE
- MASVS-RESILIENCE (where applicable)
Guardrails
- Do not claim scanner coverage that was not actually executed.
- Keep findings actionable by filtering out non-exploitable or low-signal noise.
- If scope is missing, stop and request it before running a full security assessment.
Output format
- Findings first (highest severity first).
- File references and concise impact statement per finding.
- Remediation guidance with concrete next step.
- Residual risks and follow-up checks.
Optional scanner commands
gitleaks detect --source .trufflehog filesystem .rg -n \"(api[_-]?key|secret|token|password|private[_-]?key|BEGIN RSA PRIVATE KEY)\"
Official references
- Flutter security overview: https://docs.flutter.dev/security
- OWASP MASVS: https://mas.owasp.org/MASVS/
- Google Play app security best practices: https://developer.android.com/privacy-and-security/security-best-practices
- Apple security resources: https://developer.apple.com/security/
- Anthropic Claude Code Security Review: https://github.com/anthropics/claude-code-security-review
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Wreos
- Source: Wreos/flutter-cursor-plugin
- License: MIT
- Homepage: https://docs.flutter.dev/ai/get-started
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.