{"data":{"skill":{"slug":"flutter-flutter-add-widget-preview","name":"flutter-add-widget-preview","icon":"📦","repo":"https://github.com/flutter/agent-plugins/tree/9b8106dbf09fcc1d0bda0010acc67914e6dab5e5/skills/flutter-add-widget-preview","status":"approved","author":"flutter","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"9962a2c2-ac0a-46a9-85fe-afe24cf4e32d","skill_id":"bb0a6eec-617c-4bf9-9402-961718d6b226","version":1,"content_hash":"v3:d9e5ab86dafd32a1ddde9b8b4fde177589b55b95:88cfeb7084e798714f5ac59cff62e5441759bcbe096c0fdc37abd21111b20212:9e788f92898e866b23ee2a9dafaca326e07af94022db99e463ef36020c32709c:736b696c6c732f666c75747465722f666c75747465722d6164642d7769646765742d70726576696577:2e8a17149f77d2ada7edf05a40362bfa","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 20 static findings are false positives caused by Markdown backticks, fenced Dart examples, ordinary project inspection guidance, or a fixed Flutter CLI command. No command injection, system reconnaissance, prompt injection, or malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":77,"line_start":69},{"file":"SKILL.md","line_end":80,"line_start":77},{"file":"SKILL.md","line_end":112,"line_start":80},{"file":"SKILL.md","line_end":115,"line_start":112},{"file":"SKILL.md","line_end":145,"line_start":115}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":146,"audit_model":"codex","audited_at":"2026-09-08T12:31:32.233+00:00","created_at":"2026-09-08T15:33:48.837007+00:00","static_findings":[{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Target Elements:** Apply the `@Preview` annotation to top-level functions, static methods within","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Imports:** Always import `package:flutter/widget_previews.dart` to access the preview annotation","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Custom Annotations:** Extend the `Preview` class to create custom annotations that inject common","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Multiple Configurations:** Apply multiple `@Preview` annotations to a single target to generate ","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Runtime Transformations:** Override the `transform()` method in custom `Preview` or `MultiPrevie","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **No Native APIs:** Do not use native plugins or APIs from `dart:io` or `dart:ffi`. Widgets with t","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Asset Paths:** Use package-based paths for assets loaded via `dart:ui` `fromAsset` APIs (e.g., `","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Constraints:** Apply explicit constraints using the `size` parameter in the `@Preview` annotatio","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] Import `package:flutter/widget_previews.dart`.","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] Apply the `@Preview` annotation to the target.","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] Configure preview parameters (`name`, `group`, `size`, `theme`, `brightness`, etc.) as needed.","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] If applying the same configuration to multiple widgets, extract the configuration into a custo","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Run `flutter widget-preview start`.","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":77,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":112,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":145,"severity":"medium","line_start":115},{"id":"blocker:SKILL.md:41:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- [ ] Identify a valid target (top-level function, static method, or parameter-less public construct","category":"blocker","line_end":41,"severity":"low","line_start":41},{"id":"blocker:SKILL.md:49:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**If using a supported IDE (Android Studio, IntelliJ, VS Code with Flutter 3.38+):**","category":"blocker","line_end":49,"severity":"low","line_start":49}],"finding_verdicts":[{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks format Flutter annotations and type names as inline Markdown. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks format a Dart package import path in documentation. No executable shell construct is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The backticks identify the Flutter Preview class in prose. This is Markdown formatting, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks format Dart annotation and class names. The line contains no shell interpolation or execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks mark Dart method and class identifiers in explanatory text. They have no execution semantics in Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The line warns against native Dart APIs and formats their names with Markdown. It does not run external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks format Dart APIs and asset path examples. No command interpreter or executable action is involved.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The line uses inline Markdown for a parameter and annotation name. It does not execute either value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The backticks enclose a Dart import path in a checklist. This is documentation for a source edit, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks format the Flutter Preview annotation. No external process or command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks list preview configuration field names. They are Dart API identifiers, not executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format a Dart class name in a refactoring recommendation. The line contains no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This is a documented Flutter CLI invocation with fixed arguments for starting the previewer. Markdown backticks do not execute it, and no untrusted input is interpolated.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The detected token opens a fenced Dart code example. A Markdown code fence is not Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The detected backticks close one fenced Dart example and precede another section. They are Markdown delimiters only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The detected token opens a fenced Dart source example. The contained widget preview code does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The backticks close a Dart code fence. They are static Markdown syntax with no execution behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The detected token opens the MultiPreview Dart example. The example contains ordinary Dart transformations and no external command execution.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:41:system-reconnaissance","reason":"The instruction asks the developer to select a valid Flutter declaration in the current project. It does not collect host, network, account, or environment information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:49:system-reconnaissance","reason":"The line branches on whether the developer uses a supported IDE. It neither probes the system nor gathers sensitive configuration.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"d9e5ab86dafd32a1ddde9b8b4fde177589b55b95","subject_content_hash":"88cfeb7084e798714f5ac59cff62e5441759bcbe096c0fdc37abd21111b20212","subject_tree_hash":"9e788f92898e866b23ee2a9dafaca326e07af94022db99e463ef36020c32709c","subject_plugin_path":"skills/flutter/flutter-add-widget-preview","audit_payload_hash":"2e8a17149f77d2ada7edf05a40362bfa","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"d9e5ab86dafd32a1ddde9b8b4fde177589b55b95","contentHash":"88cfeb7084e798714f5ac59cff62e5441759bcbe096c0fdc37abd21111b20212","treeHash":"9e788f92898e866b23ee2a9dafaca326e07af94022db99e463ef36020c32709c","pluginPath":"skills/flutter/flutter-add-widget-preview","auditPayloadHash":"2e8a17149f77d2ada7edf05a40362bfa"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/flutter-flutter-add-widget-preview/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}