Skills dart-setup-ffi-assets
📦
dart-setup-ffi-assets
Content revision r1 Medium Risk ⚙️ External commands🌐 Network access
Build Dart Native Assets with FFI Hooks
Native C and C++ integration in Dart requires platform-aware build, link, and packaging hooks. This skill guides local compilation, verified binary downloads, and linker tree-shaking.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "dart-setup-ffi-assets" from https://skillstore.io/skills/flutter-dart-setup-ffi-assets.md and its manifest at https://skillstore.io/api/skills/flutter-dart-setup-ffi-assets/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "dart-setup-ffi-assets". Set up local compilation for a bundled SQLite source file.
Expected outcome:
- A dependency list for hooks, code assets, native toolchains, record use, and FFIgen.
- A shared C library specification used by both build and link phases.
- A verification checklist covering tests and platform library outputs.
Using "dart-setup-ffi-assets". Use precompiled libraries while preserving offline development.
Expected outcome:
- A platform-aware download design with immutable release locations and SHA-256 verification.
- A local_build switch that compiles included sources when network access is unavailable.
- Clear failure behavior for unsupported targets and integrity mismatches.
Using "dart-setup-ffi-assets". Remove unused native symbols from a release build.
Expected outcome:
- A link-hook design that maps recorded Dart calls to native symbol names.
- Platform-specific export inspection steps for macOS, Linux, and Windows.
Security Audit
Medium Riskv1 • 8/30/2026 Open versioned report
The analyzer mostly misclassified Markdown backticks and ordinary Dart entry points as command execution or reconnaissance. The remote native-library download is confirmed, and the documented MD5 validation creates a separate integrity weakness. Privileged package installation is explicit and fixed, while certificate and Python HTTP alerts are unrelated text matches.
1
Files scanned
420
Lines analyzed
1
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Weak MD5 Validation for Downloaded Native Binaries
The skill permits MD5 for validating remotely downloaded native libraries. MD5 is collision-broken and should not protect executable artifacts.
The prose explicitly permits MD5, and the complete downloader example computes MD5 before accepting a native library.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Hardcoded URL
'https://github.com/my-org/my-native-repo/releases/download/$version/$target',
The example build hook constructs a GitHub release URL and downloads a native library during builds. Digest checking mitigates tampering but retains a remote supply-chain dependency.
Risk Factors
⚙️ External commands (50)
SKILL.md:37 SKILL.md:39 SKILL.md:40 SKILL.md:47 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:54 SKILL.md:57 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:79-81 SKILL.md:81-83 SKILL.md:83-84 SKILL.md:84-93 SKILL.md:93-96 SKILL.md:96-99 SKILL.md:99 SKILL.md:103-105 SKILL.md:105-124 SKILL.md:124-128 SKILL.md:128-131 SKILL.md:131-133 SKILL.md:133-135 SKILL.md:135-137 SKILL.md:137-144 SKILL.md:144 SKILL.md:146-153 SKILL.md:153-155 SKILL.md:155 SKILL.md:157-164 SKILL.md:164-168 SKILL.md:168-170 SKILL.md:170-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183 SKILL.md:185-205 SKILL.md:205-207 SKILL.md:207-209 SKILL.md:209 SKILL.md:211-232 SKILL.md:232-238 SKILL.md:238-250 SKILL.md:250 SKILL.md:252-255 SKILL.md:255-261 SKILL.md:261-263
🌐 Network access (2)
Audited by: codex
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/flutter-dart-setup-ffi-assets?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/flutter-dart-setup-ffi-assets?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/flutter-dart-setup-ffi-assets/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/flutter-dart-setup-ffi-assets.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
flutter. (2026). dart-setup-ffi-assets security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1BibTeX citation
@techreport{flutter-flutter-dart-setup-ffi-assets-2026,
author = {flutter},
title = {dart-setup-ffi-assets security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dart-setup-ffi-assets security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "flutter"
date-released: "2026-08-30"
url: "https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1"
identifiers:
- type: other
value: "skillstore:flutter-dart-setup-ffi-assets:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance
What You Can Build
Add Native Code to a Dart Package
Create build hooks that compile included C sources and register the resulting library as a Dart Code Asset.
Package Native Libraries for Flutter
Prepare platform-specific dynamic libraries for automatic bundling across macOS, Linux, and Windows.
Reduce Native Binary Size
Connect FFIgen usage records to a link hook that removes unreferenced native symbols.
Try These Prompts
Create a Basic Build Hook
Set up a Dart Native Assets build hook for my C sources. Use native_toolchain_c and explain every required file.
Add FFI Bindings
Integrate FFIgen bindings with my Native Assets setup. Include the shared library specification and platform export requirements.
Package Precompiled Libraries
Design a build hook that downloads platform-specific native libraries, verifies SHA-256 hashes, and supports an offline local-build fallback.
Implement Native Tree-Shaking
Add a link hook using record_use mappings and native_toolchain_c tree-shaking. Include tests for retained and removed symbols.
Best Practices
- Resolve package paths with Uri APIs and keep hooks platform-independent.
- Use SHA-256 or stronger digests for every downloaded native binary.
- Test local, offline, unsupported-platform, and symbol-stripping paths in continuous integration.
Avoid
- Do not invoke compilers through dynamically constructed shell commands.
- Do not download or register native binaries before verifying their source and digest.
- Do not hardcode generated output directories or host-specific absolute paths.
Frequently Asked Questions
Does this skill require a local compiler?
Local compilation requires Xcode tools, GCC, Clang, or MSVC. Precompiled downloads can avoid that requirement.
Which Dart packages does the guidance use?
It uses hooks, code_assets, native_toolchain_c, record_use, and FFIgen for build, link, packaging, and binding tasks.
Can it support offline development?
Yes. The documented local_build option uses included sources and an installed compiler without downloading binaries.
How are downloaded libraries validated?
The skill demonstrates digest validation. Production projects should replace illustrative MD5 values with trusted SHA-256 or stronger digests.
Does it support native symbol tree-shaking?
Yes. It maps recorded Dart FFI method use to native symbols and passes those symbols to linker tree-shaking.
Which desktop platforms are covered?
The examples cover macOS dynamic libraries, Linux shared objects, and Windows DLL files.