# Security Audit

> Perform a practical security audit for Flutter/Dart projects, including secrets scanning and prioritized remediation guidance.

- **Type:** Skill
- **Install:** `agentstack add skill-wreos-flutter-cursor-plugin-security-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Wreos](https://agentstack.voostack.com/s/wreos)
- **Installs:** 0
- **Category:** [Content & Media](https://agentstack.voostack.com/c/content-and-media)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Wreos](https://github.com/Wreos)
- **Source:** https://github.com/Wreos/flutter-cursor-plugin/tree/main/skills/security-audit
- **Website:** https://docs.flutter.dev/ai/get-started

## Install

```sh
agentstack add skill-wreos-flutter-cursor-plugin-security-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Audit

Use this skill for `/security-review` style checks.

Every code review must include this security pass.

## Workflow

1. Require explicit target scope (pending diff, PR range, or file set). If missing, request it first.
2. Start diff-aware: review pending changes first, then expand to dependent context.
3. Run repository-level secrets checks.
4. Review code for high-risk patterns:
   - hardcoded credentials/tokens/keys
   - insecure storage or logging of sensitive data
   - missing TLS/certificate validation controls
   - unsafe deserialization / dynamic execution patterns
   - insufficient authz/authn checks in app/service boundaries
5. Review mobile-specific concerns:
   - Android/iOS configuration leaks
   - debug flags/logging in release paths
   - weak handling of deep links/intent data
6. Apply false-positive filtering (remove low-impact/no-exploitability noise).
7. Classify findings by severity and exploitability.
8. Provide minimal safe fixes and validation steps.

## OWASP MASVS coverage (required)

- MASVS-ARCH
- MASVS-STORAGE
- MASVS-CRYPTO
- MASVS-AUTH
- MASVS-NETWORK
- MASVS-PLATFORM
- MASVS-CODE
- MASVS-RESILIENCE (where applicable)

## Guardrails

- Do not claim scanner coverage that was not actually executed.
- Keep findings actionable by filtering out non-exploitable or low-signal noise.
- If scope is missing, stop and request it before running a full security assessment.

## Output format

- Findings first (highest severity first).
- File references and concise impact statement per finding.
- Remediation guidance with concrete next step.
- Residual risks and follow-up checks.

## Optional scanner commands

- `gitleaks detect --source .`
- `trufflehog filesystem .`
- `rg -n \"(api[_-]?key|secret|token|password|private[_-]?key|BEGIN RSA PRIVATE KEY)\"`

## Official references

- Flutter security overview: https://docs.flutter.dev/security
- OWASP MASVS: https://mas.owasp.org/MASVS/
- Google Play app security best practices: https://developer.android.com/privacy-and-security/security-best-practices
- Apple security resources: https://developer.apple.com/security/
- Anthropic Claude Code Security Review: https://github.com/anthropics/claude-code-security-review

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Wreos](https://github.com/Wreos)
- **Source:** [Wreos/flutter-cursor-plugin](https://github.com/Wreos/flutter-cursor-plugin)
- **License:** MIT
- **Homepage:** https://docs.flutter.dev/ai/get-started

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-wreos-flutter-cursor-plugin-security-audit
- Seller: https://agentstack.voostack.com/s/wreos
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.