技能 dart-setup-ffi-assets
📦
dart-setup-ffi-assets
内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问
Build Dart Native Assets with FFI Hooks
Native C and C++ integration in Dart requires platform-aware build, link, and packaging hooks. This skill guides local compilation, verified binary downloads, and linker tree-shaking.
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "dart-setup-ffi-assets" from https://skillstore.io/skills/flutter-dart-setup-ffi-assets.md and its manifest at https://skillstore.io/api/skills/flutter-dart-setup-ffi-assets/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“dart-setup-ffi-assets”。 Set up local compilation for a bundled SQLite source file.
预期结果:
- A dependency list for hooks, code assets, native toolchains, record use, and FFIgen.
- A shared C library specification used by both build and link phases.
- A verification checklist covering tests and platform library outputs.
正在使用“dart-setup-ffi-assets”。 Use precompiled libraries while preserving offline development.
预期结果:
- A platform-aware download design with immutable release locations and SHA-256 verification.
- A local_build switch that compiles included sources when network access is unavailable.
- Clear failure behavior for unsupported targets and integrity mismatches.
正在使用“dart-setup-ffi-assets”。 Remove unused native symbols from a release build.
预期结果:
- A link-hook design that maps recorded Dart calls to native symbol names.
- Platform-specific export inspection steps for macOS, Linux, and Windows.
安全审计
中风险v1 • 2026/8/30 打开版本化报告
The analyzer mostly misclassified Markdown backticks and ordinary Dart entry points as command execution or reconnaissance. The remote native-library download is confirmed, and the documented MD5 validation creates a separate integrity weakness. Privileged package installation is explicit and fixed, while certificate and Python HTTP alerts are unrelated text matches.
1
已扫描文件
420
分析行数
1
复核项
0
已忽略误报
已确认安全问题 (1)
中
Weak MD5 Validation for Downloaded Native Binaries
The skill permits MD5 for validating remotely downloaded native libraries. MD5 is collision-broken and should not protect executable artifacts.
The prose explicitly permits MD5, and the complete downloader example computes MD5 before accepting a native library.
能力复核项 (1)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
低
Hardcoded URL
'https://github.com/my-org/my-native-repo/releases/download/$version/$target',
The example build hook constructs a GitHub release URL and downloads a native library during builds. Digest checking mitigates tampering but retains a remote supply-chain dependency.
风险因素
⚙️ 外部命令 (50)
SKILL.md:37 SKILL.md:39 SKILL.md:40 SKILL.md:47 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:54 SKILL.md:57 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:79-81 SKILL.md:81-83 SKILL.md:83-84 SKILL.md:84-93 SKILL.md:93-96 SKILL.md:96-99 SKILL.md:99 SKILL.md:103-105 SKILL.md:105-124 SKILL.md:124-128 SKILL.md:128-131 SKILL.md:131-133 SKILL.md:133-135 SKILL.md:135-137 SKILL.md:137-144 SKILL.md:144 SKILL.md:146-153 SKILL.md:153-155 SKILL.md:155 SKILL.md:157-164 SKILL.md:164-168 SKILL.md:168-170 SKILL.md:170-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183 SKILL.md:185-205 SKILL.md:205-207 SKILL.md:207-209 SKILL.md:209 SKILL.md:211-232 SKILL.md:232-238 SKILL.md:238-250 SKILL.md:250 SKILL.md:252-255 SKILL.md:255-261 SKILL.md:261-263
🌐 网络访问 (2)
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/flutter-dart-setup-ffi-assets?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/flutter-dart-setup-ffi-assets?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/flutter-dart-setup-ffi-assets/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/flutter-dart-setup-ffi-assets.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
flutter. (2026). dart-setup-ffi-assets security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1BibTeX 引用
@techreport{flutter-flutter-dart-setup-ffi-assets-2026,
author = {flutter},
title = {dart-setup-ffi-assets security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dart-setup-ffi-assets security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "flutter"
date-released: "2026-08-30"
url: "https://skillstore.io/skills/flutter-dart-setup-ffi-assets/audits/1"
identifiers:
- type: other
value: "skillstore:flutter-dart-setup-ffi-assets:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
65
社区
83
规范符合性
你能构建什么
Add Native Code to a Dart Package
Create build hooks that compile included C sources and register the resulting library as a Dart Code Asset.
Package Native Libraries for Flutter
Prepare platform-specific dynamic libraries for automatic bundling across macOS, Linux, and Windows.
Reduce Native Binary Size
Connect FFIgen usage records to a link hook that removes unreferenced native symbols.
试试这些提示
Create a Basic Build Hook
Set up a Dart Native Assets build hook for my C sources. Use native_toolchain_c and explain every required file.
Add FFI Bindings
Integrate FFIgen bindings with my Native Assets setup. Include the shared library specification and platform export requirements.
Package Precompiled Libraries
Design a build hook that downloads platform-specific native libraries, verifies SHA-256 hashes, and supports an offline local-build fallback.
Implement Native Tree-Shaking
Add a link hook using record_use mappings and native_toolchain_c tree-shaking. Include tests for retained and removed symbols.
最佳实践
- Resolve package paths with Uri APIs and keep hooks platform-independent.
- Use SHA-256 or stronger digests for every downloaded native binary.
- Test local, offline, unsupported-platform, and symbol-stripping paths in continuous integration.
避免
- Do not invoke compilers through dynamically constructed shell commands.
- Do not download or register native binaries before verifying their source and digest.
- Do not hardcode generated output directories or host-specific absolute paths.
常见问题
Does this skill require a local compiler?
Local compilation requires Xcode tools, GCC, Clang, or MSVC. Precompiled downloads can avoid that requirement.
Which Dart packages does the guidance use?
It uses hooks, code_assets, native_toolchain_c, record_use, and FFIgen for build, link, packaging, and binding tasks.
Can it support offline development?
Yes. The documented local_build option uses included sources and an installed compiler without downloading binaries.
How are downloaded libraries validated?
The skill demonstrates digest validation. Production projects should replace illustrative MD5 values with trusted SHA-256 or stronger digests.
Does it support native symbol tree-shaking?
Yes. It maps recorded Dart FFI method use to native symbols and passes those symbols to linker tree-shaking.
Which desktop platforms are covered?
The examples cover macOS dynamic libraries, Linux shared objects, and Windows DLL files.