What problem does it solve? Flutter apps compile all Dart code into binaries running on untrusted devices, so hardcoded secrets, plaintext storage, and vulnerable packages ship directly to attackers. This Skill performs static security review of Flutter/Dart codebases, catching these issues before release without pen-testing or runtime analysis. ## Core Features & Use Cases - Secrets & Storage Audit: Detects hardcoded API keys, --dart-define workarounds, tokens in SharedPreferences, and sensitive data in logs, with severity labels (Critical/Warning/Note) on every finding. - Dependency Vulnerability Scanning: Runs osv-scanner against pubspec.lock, audits ignored_advisories entries for documented justification, and flags typosquatting and transitive permission creep. - Secure Implementation Replacement: When asked to implement an insecure pattern (custom biometric channels, disabled certificate validation), it delivers the secure alternative using flutter_secure_storage, local_auth, formz, or http_certificate_pinning in the same response. - Use Case: Before cutting a release, ask it to review your codebase — it flags a JWT stored in SharedPreferences as Critical, an unjustified ignored_advisories entry as Warning, and provides the corrected code for each. ## Quick Start Ask the assistant to run a static security review of your Flutter project directory and report findings by severity before your next release.
