static-security
FeaturedStatic security review for Flutter mobile apps and Dart code, flagging hardcoded secrets, insecure storage, unsafe network calls, leaky logs, and vulnerable dependencies. Use when reviewing or writing code that handles secrets, user data, network communication, authentication, or cryptography, or when adding validation to user input such as login, sign-up, or payment forms whose values reach a repository or an API, with prompts like "add validation to this form", "nothing is checked before this hits the API", or "validate these fields". Also use for dependency vulnerability review, a security audit even when the request never says "security": "we cut a release tomorrow, is this pubspec safe", "check our dependencies for known vulnerabilities", "scan for CVEs", "we have an ignored_advisories entry, is that fine", or "these versions are pinned, what are we exposed to".
Install
Quality Score: 90/100
Skill Content
Details
- Author
- VeryGoodOpenSource
- Repository
- VeryGoodOpenSource/vgv-ai-flutter-plugin
- Created
- 7 months ago
- Last Updated
- 4 days ago
- Language
- Shell
- License
- MIT
Bundled in these plugins
Similar Skills
Semantically similar based on skill content — not just same category
flutter-security
Threat-model, audit, or harden Flutter and Dart applications against concrete security and privacy risks involving authorization, secrets, sensitive storage, cryptography, WebViews, deep links, platform exposure, or dependencies. Use for security findings and control requirements; route sign-in and session implementation to flutter-authentication.
security-audit
Use when auditing code for security vulnerabilities, reviewing auth, permissions or Firestore/Storage rules, before a release or store submission, after a pentest or bug report, when handling secrets, tokens or PII, or when asked "is this secure", "find security holes", "check for vulnerabilities", or "review my rules". Deepest on Flutter + Firebase (Firestore, Storage, Cloud Functions, App Check); the method works on any stack.
padosoft-mobile-security-review
Use this skill before committing or reviewing a change to a React Native / Expo app that touches secrets or API keys, token storage, a WebView, a deep link or an external URL, TLS and certificate pinning, a dev/mock/debug surface, or an AI/LLM call — and whenever the user asks whether something can go in the bundle, in an EXPO_PUBLIC_ variable or in MMKV, or asks for a mobile security review or an audit. It runs the checks with their pre-screens and, for a finding whose enforcement lives outside the repository, states the severity conditionally instead of guessing. Do not use it for API-side security (padosoft-api-security-review), store review rejections, or MDM and device fleet policy.