client.badCertificateCallback = (cert, host, port) => true, added once for a staging server, or an API secret in lib/config.dart: both ship inside every APK and IPA you release, where anyone can pull them out or sit between your users and your server. This skill finds those and eleven other Flutter and Dart mistakes before you ship, and tells you how to fix each one.

Your agent runs a scanner on your Dart code, pubspec.yaml and pubspec.lock. It reads Dart as Dart (comments, raw and triple-quoted strings, $name and ${...} interpolation), skips tests, generated files and build folders, and knows the usual guards: if (kDebugMode), assert, a navigation allow list, ? placeholders in SQL. Keys meant to ship in apps (Firebase, Google Maps, Stripe publishable, Supabase anon, Algolia search-only) are not reported; a Supabase service_role key is, even under a harmless name, because the scanner reads the role inside the key offline. It never runs flutter, pub or your app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• F01: secrets compiled into the app (known key formats, Supabase service_role keys, long values in secret-named fields, fixed Authorization headers, keys in URL queries, Gemini keys, String.fromEnvironment defaults)

• F02: badCertificateCallback or onBadCertificate returning true, and WebView SSL errors that always proceed

• F03: http:// and ws:// servers on the public internet

• F04: packages downloaded over http:// or git://

REVIEW (check before release)

• F11: tokens and passwords saved in shared_preferences, GetStorage or an unencrypted Hive box

• F12: tokens printed with print or debugPrint, and HTTP loggers left on in release builds

• F13: git dependencies without a ref or pinned to a branch

• F14: any versions, missing versions and open-ended ranges

• F15: dependency_overrides left in pubspec.yaml

• F16: WebView JavaScript channels on remote pages without a navigation allow list

• F17: .env, key and credentials files bundled as Flutter assets

• F18: sqflite and drift SQL built with string interpolation

• F19: http:// and ws:// to private-network addresses (192.168.x.x, .local, .lan, .internal) outside debug builds

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example Flutter project, and the real report the scanner produces on the risky one

Limits

It reads each file on its own: values passed between files, platform code in android/ and ios/ (check the manifest and Info.plist separately), native plugins and known vulnerabilities in package versions are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 27 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (18 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.