Flutter security

Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/flutter-security

OWASP Mobile security standards for Flutter. ALWAYS consult when storing data, making network calls, handling tokens/PII, or preparing a release build — not just dedicated security tasks. (triggers: lib/infrastructure/**, pubspec.yaml, secure_storage, obfuscate, jailbreak, pinning, PII, OWASP)From its SKILL.md

Install

npx -y skills add ComeOnOliver/skillshub --skill flutter-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.8 KB, 344 tokens by cl100k_base, as published. Nobody here has run it

Mobile Security

Priority: P0 (CRITICAL)

Standards for basic mobile security and PII protection.

Implementation Guidelines

Secure Storage: Use flutter_secure_storage for tokens/PII. Never use shared_preferences.
Hardcoding: Never store API keys or secrets in Dart code. Use --dart-define or .env.
Obfuscation: Always release with --obfuscate and --split-debug-info. Note: This is a deterrent, not cryptographic protection. For sensitive logic, move to backend.
SSL Pinning: For high-security apps, use dio_certificate_pinning.
Root Detection: Use flutter_jailbreak_detection for financial/sensitive applications.
PII Masking: Mask sensitive data (email, phone) in logs and analytics.

Reference & Examples

For SSL Pinning and Secure Storage implementation details: See references/REFERENCE.md.

Anti-Patterns

❌ prefs.setString('auth_token', token) — tokens/PII must use flutter_secure_storage, never SharedPreferences
❌ const apiKey = 'sk-…' hardcoded in Dart — store secrets via --dart-define or a secure vault; never in source
❌ Release build without --obfuscate --split-debug-info flags — unobfuscated binaries expose class/method names
❌ print('User email: $email') — mask or omit PII in logs and analytics events entirely

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.