{"data":{"skill":{"slug":"jeffallan-flutter-expert","name":"flutter-expert","icon":"📦","repo":"https://github.com/jeffallan/claude-skills/tree/main/skills/flutter-expert/","status":"approved","author":"jeffallan","authorVersion":"1.1.0","skillstoreRevision":2},"audit":{"id":"bbd23750-c2cd-42c0-982b-643c89514eb7","skill_id":"4b209bd5-2d8f-44cb-a17b-6e0241e0b313","version":5,"content_hash":"v3:1c2ebded2116f8124f45dba86a2e567f56e64d8e:0fe1313754652dc7e98e9189f5c16565cfeeb5d8c96682ce74cbe940f9076f78:d1c2d09b662ae204559e762c3bd540cca66ebd9a3fc70e45e9553883a4e4bdf6:736b696c6c732f6a656666616c6c616e2f666c75747465722d657870657274:88a001abbb77de8d260086508efcbb4a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 53 static findings are false positives in Flutter documentation and code examples. The flagged key, state-expression, command, and URL patterns do not show credential access, unauthorized execution, exfiltration, or prompt injection.","remediation":[{"issue":"Static analysis labels Dart constructor keys as certificate or key files.","severity":"safe","suggestion":"Retain the constructor examples, and improve scanner rules to distinguish Dart `super.key` from credential or certificate material."},{"issue":"Static analysis labels ordinary state expressions as system reconnaissance.","severity":"safe","suggestion":"Retain the state-management examples, and classify Dart state access and boolean expressions separately from host or environment discovery."},{"issue":"Static analysis labels documented Flutter commands and documentation URLs as execution or network risks.","severity":"low","suggestion":"Keep commands limited to the stated development workflow and use trusted documentation links. Scanner rules should distinguish Markdown examples and fixed documentation URLs from runtime behavior."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":79,"line_start":58},{"file":"SKILL.md","line_end":83,"line_start":79},{"file":"SKILL.md","line_end":102,"line_start":83},{"file":"SKILL.md","line_end":107,"line_start":102},{"file":"SKILL.md","line_end":109,"line_start":107},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":115,"line_start":112},{"file":"SKILL.md","line_end":117,"line_start":115},{"file":"SKILL.md","line_end":118,"line_start":117},{"file":"SKILL.md","line_end":120,"line_start":118},{"file":"SKILL.md","line_end":126,"line_start":120},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":128,"line_start":127},{"file":"SKILL.md","line_end":129,"line_start":128},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":130,"line_start":130}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":6,"line_start":6},{"file":"SKILL.md","line_end":140,"line_start":140}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":7,"total_lines":995,"audit_model":"codex","audited_at":"2026-08-07T09:37:13.065+00:00","created_at":"2026-08-07T11:48:41.355283+00:00","static_findings":[{"id":"sensitive:references/bloc-state.md:120:certificate-key-files","file":"references/bloc-state.md","pattern":"Certificate/key files","snippet":"const CounterScreen({super.key});","category":"sensitive","line_end":120,"severity":"high","line_start":120},{"id":"blocker:references/bloc-state.md:84:system-reconnaissance","file":"references/bloc-state.md","pattern":"System reconnaissance","snippet":"void increment() => emit(state + 1);","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:references/bloc-state.md:85:system-reconnaissance","file":"references/bloc-state.md","pattern":"System reconnaissance","snippet":"void decrement() => emit(state - 1);","category":"blocker","line_end":85,"severity":"low","line_start":85},{"id":"blocker:references/bloc-state.md:167:system-reconnaissance","file":"references/bloc-state.md","pattern":"System reconnaissance","snippet":"onPressed: state.isValid","category":"blocker","line_end":168,"severity":"low","line_start":167},{"id":"sensitive:references/gorouter-navigation.md:40:certificate-key-files","file":"references/gorouter-navigation.md","pattern":"Certificate/key files","snippet":"const MyApp({super.key});","category":"sensitive","line_end":40,"severity":"high","line_start":40},{"id":"blocker:references/gorouter-navigation.md:25:system-reconnaissance","file":"references/gorouter-navigation.md","pattern":"System reconnaissance","snippet":"final id = state.pathParameters['id']!;","category":"blocker","line_end":25,"severity":"low","line_start":25},{"id":"sensitive:references/project-structure.md:104:certificate-key-files","file":"references/project-structure.md","pattern":"Certificate/key files","snippet":"const MyApp({super.key});","category":"sensitive","line_end":104,"severity":"high","line_start":104},{"id":"blocker:references/project-structure.md:96:system-reconnaissance","file":"references/project-structure.md","pattern":"System reconnaissance","snippet":"void main() async {","category":"blocker","line_end":96,"severity":"low","line_start":96},{"id":"sensitive:references/riverpod-state.md:70:certificate-key-files","file":"references/riverpod-state.md","pattern":"Certificate/key files","snippet":"const TodoScreen({super.key});","category":"sensitive","line_end":70,"severity":"high","line_start":70},{"id":"sensitive:references/riverpod-state.md:94:certificate-key-files","file":"references/riverpod-state.md","pattern":"Certificate/key files","snippet":"const UserAvatar({super.key});","category":"sensitive","line_end":94,"severity":"high","line_start":94},{"id":"blocker:references/riverpod-state.md:31:system-reconnaissance","file":"references/riverpod-state.md","pattern":"System reconnaissance","snippet":"void add(Todo todo) {","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"blocker:references/riverpod-state.md:35:system-reconnaissance","file":"references/riverpod-state.md","pattern":"System reconnaissance","snippet":"void toggle(String id) {","category":"blocker","line_end":35,"severity":"low","line_start":35},{"id":"blocker:references/riverpod-state.md:38:system-reconnaissance","file":"references/riverpod-state.md","pattern":"System reconnaissance","snippet":"if (todo.id == id) todo.copyWith(completed: !todo.completed) else todo,","category":"blocker","line_end":38,"severity":"low","line_start":38},{"id":"blocker:references/riverpod-state.md:42:system-reconnaissance","file":"references/riverpod-state.md","pattern":"System reconnaissance","snippet":"void remove(String id) {","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:references/riverpod-state.md:43:system-reconnaissance","file":"references/riverpod-state.md","pattern":"System reconnaissance","snippet":"state = state.where((t) => t.id != id).toList();","category":"blocker","line_end":43,"severity":"low","line_start":43},{"id":"sensitive:references/widget-patterns.md:12:certificate-key-files","file":"references/widget-patterns.md","pattern":"Certificate/key files","snippet":"super.key,","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"sensitive:references/widget-patterns.md:41:certificate-key-files","file":"references/widget-patterns.md","pattern":"Certificate/key files","snippet":"super.key,","category":"sensitive","line_end":41,"severity":"high","line_start":41},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Setup** — Scaffold project, add dependencies (`flutter pub get`), configure routing","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **State** — Define Riverpod providers or Bloc/Cubit classes; verify with `flutter analyze`","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If `flutter analyze` reports issues: fix all lints and warnings before proceeding; re-run until cl","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Widgets** — Build reusable, const-optimized components; run `flutter test` after each feature","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If tests fail: inspect widget tree with Flutter DevTools, fix failing assertions, re-run `flutter ","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Test** — Write widget and integration tests; confirm with `flutter test --coverage`","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Optimize** — Profile with Flutter DevTools (`flutter run --profile`), eliminate jank, reduce re","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If jank persists: check rebuild counts in the Performance overlay, isolate expensive `build()` cal","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Riverpod | `references/riverpod-state.md` | State management, providers, notifiers |","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Bloc | `references/bloc-state.md` | Bloc, Cubit, event-driven state, complex business logic |","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| GoRouter | `references/gorouter-navigation.md` | Navigation, routing, deep linking |","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Widgets | `references/widget-patterns.md` | Building UI components, const optimization |","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Structure | `references/project-structure.md` | Setting up project, architecture |","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Performance | `references/performance.md` | Optimization, profiling, jank fixes |","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":79,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":83,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":102,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `const` constructors wherever possible","category":"external_commands","line_end":109,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `Consumer`/`ConsumerWidget` for state (not `StatefulWidget`)","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Test widgets with `flutter_test`","category":"external_commands","line_end":115,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Build widgets inside `build()` method","category":"external_commands","line_end":117,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `setState` for app-wide state","category":"external_commands","line_end":118,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Skip `const` on static widgets","category":"external_commands","line_end":120,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Block UI thread with heavy computation (use `compute()`)","category":"external_commands","line_end":126,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `flutter analyze` errors | Unresolved imports, missing `const`, type mismatches | Fix flagged line","category":"external_commands","line_end":126,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Widget test assertion failures | Widget tree mismatch or async state not settled | Use `tester.pum","category":"external_commands","line_end":128,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Build fails after adding package | Incompatible dependency version | Run `flutter pub upgrade --ma","category":"external_commands","line_end":129,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Jank / dropped frames | Expensive `build()` calls, uncached widgets, heavy main-thread work | Use ","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Hot reload not reflecting changes | State held in `StateNotifier` not reset | Use hot restart (`R`","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"network:SKILL.md:6:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"author: https://github.com/Jeffallan","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:SKILL.md:140:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[Documentation](https://jeffallan.github.io/claude-skills/skills/frontend/flutter-expert/)","category":"network","line_end":140,"severity":"low","line_start":140},{"id":"sensitive:SKILL.md:71:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"const CounterView({super.key});","category":"sensitive","line_end":71,"severity":"high","line_start":71},{"id":"sensitive:SKILL.md:92:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"const GoodCounter({super.key});","category":"sensitive","line_end":92,"severity":"high","line_start":92},{"id":"blocker:SKILL.md:66:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"void increment() => state = state + 1; // new instance, never mutate","category":"blocker","line_end":66,"severity":"low","line_start":66},{"id":"blocker:SKILL.md:87:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"void _inc() => setState(() => _count++); // causes full subtree rebuild","category":"blocker","line_end":87,"severity":"low","line_start":87}],"finding_verdicts":[{"id":"sensitive:references/bloc-state.md:120:certificate-key-files","reason":"The match is `const CounterScreen({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/bloc-state.md:84:system-reconnaissance","reason":"The match is `emit(state + 1)` inside a Cubit counter method. It updates application state and performs no host or environment discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/bloc-state.md:85:system-reconnaissance","reason":"The match is `emit(state - 1)` inside a Cubit counter method. It updates application state and performs no host or environment discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/bloc-state.md:167:system-reconnaissance","reason":"The match is a `state.isValid` check controlling a button. It is ordinary form-state logic, not system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/gorouter-navigation.md:40:certificate-key-files","reason":"The match is `const MyApp({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/gorouter-navigation.md:25:system-reconnaissance","reason":"The code reads a GoRouter path parameter named `id` to construct a details screen. Route parameter handling is not host or environment discovery.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/project-structure.md:104:certificate-key-files","reason":"The match is `const MyApp({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/project-structure.md:96:system-reconnaissance","reason":"The code initializes Flutter bindings before local storage setup. This is normal application startup and does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/riverpod-state.md:70:certificate-key-files","reason":"The match is `const TodoScreen({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/riverpod-state.md:94:certificate-key-files","reason":"The match is `const UserAvatar({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/riverpod-state.md:31:system-reconnaissance","reason":"The code appends a Todo object to Riverpod state. It performs application-state management and does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/riverpod-state.md:35:system-reconnaissance","reason":"The code defines a Todo toggle method. It transforms in-memory application state and does not perform system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/riverpod-state.md:38:system-reconnaissance","reason":"The code copies a Todo with an updated completion flag. This is ordinary immutable state handling, not host or environment discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/riverpod-state.md:42:system-reconnaissance","reason":"The code defines a method that removes a Todo by identifier. It only filters application data and does not inspect the system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/riverpod-state.md:43:system-reconnaissance","reason":"The code filters a Todo list by identifier. This is a local state transformation with no reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/widget-patterns.md:12:certificate-key-files","reason":"The match is `super.key` in a widget constructor. It is a Flutter widget key parameter and not certificate, private key, or credential content.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/widget-patterns.md:41:certificate-key-files","reason":"The match is `super.key` in a responsive widget constructor. It is a Flutter widget key parameter and not certificate, private key, or credential content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"This line documents the fixed Flutter command `flutter pub get` in a Markdown workflow. It is instructional text, not executable Ruby backtick code or a user-controlled command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This line documents the fixed Flutter command `flutter analyze` in a Markdown workflow. It is instructional text, not executable Ruby backtick code or a user-controlled command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"This line refers to the fixed Flutter analyzer command in prose. It contains no executable shell wrapper, interpolation, or attacker-controlled argument.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"This line documents the fixed Flutter command `flutter test` as a development check. It is instructional Markdown and not dynamic command execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"This line refers to rerunning a fixed Flutter test command after inspecting failures. It does not execute a command or pass untrusted input.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"This line documents the fixed Flutter command `flutter test --coverage`. It is a code example for development workflow, not runtime execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This line documents the fixed profiling command `flutter run --profile`. It is instructional text with no dynamic shell input.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"This line discusses Flutter performance inspection and contains no executable command or untrusted input. The surrounding workflow is legitimate development guidance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This line names a local reference file in Markdown. It does not invoke a shell, Ruby backtick expression, or external process.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"This line names a local reference file in Markdown. It does not invoke a shell, Ruby backtick expression, or external process.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"This line names a local reference file in Markdown. It does not invoke a shell, Ruby backtick expression, or external process.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"This line names a local reference file in Markdown. It does not invoke a shell, Ruby backtick expression, or external process.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"This line names a local reference file in Markdown. It does not invoke a shell, Ruby backtick expression, or external process.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This line names a local reference file in Markdown. It does not invoke a shell, Ruby backtick expression, or external process.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"This line opens a fenced Dart documentation example. Markdown fencing is not Ruby shell execution and contains no runtime behavior by itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"This line closes a fenced Dart documentation example. Markdown fencing is not Ruby shell execution and contains no runtime behavior by itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"This line opens a second fenced Dart documentation example. Markdown fencing is not Ruby shell execution and contains no runtime behavior by itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"This line closes a fenced Dart documentation example. Markdown fencing is not Ruby shell execution and contains no runtime behavior by itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"This line is a documented Flutter constraint about using const constructors. It does not invoke an external process or execute shell syntax.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"This line is a documented Flutter constraint about Consumer widgets. It contains no command execution or dynamic input.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"This line is a documented Flutter testing recommendation. It does not invoke an external process or execute shell syntax.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"This line is a documented widget-design constraint. It contains no external command or executable interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"This line is a documented state-management constraint. It contains no external command or executable interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"This line is a documented const-usage constraint. It contains no external command or executable interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"This line recommends Flutter compute for heavy work. It is guidance about application concurrency, not a shell or Ruby execution primitive.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"This line documents `flutter analyze` and `flutter pub get` as fixed troubleshooting commands. It does not contain dynamic command execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"This line documents `pumpAndSettle()` for widget tests. It is Dart testing guidance, not an external process invocation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"This line documents `flutter pub upgrade --major-versions` as a fixed dependency troubleshooting command. It is not dynamic execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"This line documents Flutter performance remedies such as `compute()` and `RepaintBoundary`. It contains no shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"This line documents hot restart using the fixed terminal key `R`. It does not execute an external command or process.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:6:hardcoded-url","reason":"The URL is a GitHub author metadata link in the front matter. It is not a runtime network request or an exfiltration destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:140:hardcoded-url","reason":"The URL points to the skill author's public documentation. It is a fixed reference link, not runtime networking or data transmission.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:71:certificate-key-files","reason":"The match is `const CounterView({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:92:certificate-key-files","reason":"The match is `const GoodCounter({super.key});`, a standard Flutter widget constructor parameter. It contains no certificate, private key, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:66:system-reconnaissance","reason":"The expression increments a Riverpod counter state value. It changes application state and does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:87:system-reconnaissance","reason":"The expression increments a local Flutter counter inside setState. It is a benign example of state updates, not system reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"1c2ebded2116f8124f45dba86a2e567f56e64d8e","subject_content_hash":"0fe1313754652dc7e98e9189f5c16565cfeeb5d8c96682ce74cbe940f9076f78","subject_tree_hash":"d1c2d09b662ae204559e762c3bd540cca66ebd9a3fc70e45e9553883a4e4bdf6","subject_plugin_path":"skills/jeffallan/flutter-expert","audit_payload_hash":"88a001abbb77de8d260086508efcbb4a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"1c2ebded2116f8124f45dba86a2e567f56e64d8e","contentHash":"0fe1313754652dc7e98e9189f5c16565cfeeb5d8c96682ce74cbe940f9076f78","treeHash":"d1c2d09b662ae204559e762c3bd540cca66ebd9a3fc70e45e9553883a4e4bdf6","pluginPath":"skills/jeffallan/flutter-expert","auditPayloadHash":"88a001abbb77de8d260086508efcbb4a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/jeffallan-flutter-expert/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}