Skip to content
skillsafebeta
← Report library
Purpose / Other

Flutter Add Integration Test Skill Security Audit

What the author says it does (original text)

Configures Flutter Driver for app interaction and converts MCP actions into permanent integration tests. Use when adding integration testing to a project, exploring UI components via MCP, or automating user flows with the integration_test package.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The test-control extension may be added to the normal application entry point

Source references: 2
What we found

The instructions permit modifying the usual `lib/main.dart` and require enabling the Flutter Driver extension unconditionally before `runApp()`. They do not isolate it behind a build-mode guard or require verification that production builds exclude that entry point.

Why this matters

If the same entry point is later used for a non-test or released build, the application will contain a control interface intended for test automation, expanding the surface through which its UI can be inspected and manipulated.

The instructions explicitly allow modifying the normal `lib/main.dart` and enabling the Flutter Driver extension before `runApp()`; the checklist repeats that injection. A dedicated `main_test.dart` is offered as an alternative, but test-only gating is not required. If the normal entry point is chosen, the control extension could enter non-test builds and broaden automated control or inspection of the app. Users can require a separate test entry point and verification that release builds exclude the extension.

SKILL.md:27In the instructionsOpen original file
   ```2. Enable the Flutter Driver extension in your application entry point (typically `lib/main.dart` or a dedicated `lib/main_test.dart`):   - Import `package:flutter_driver/driver_extension.dart`.   - Call `enableFlutterDriverExtension();` before `runApp()`.3. Add `Key` parameters (e.g., `ValueKey('login_button')`) to critical widgets in the application code to ensure reliable targeting during tests.
Show 1 other places
SKILL.md:75In the instructionsOpen original file
- [ ] **Task Progress: Setup**  - [ ] Add `integration_test` and `flutter_test` to `pubspec.yaml`.  - [ ] Inject `enableFlutterDriverExtension()` into the app entry point.  - [ ] Assign `ValueKey`s to target widgets.- [ ] **Task Progress: Exploration**
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Interactive exploration and repeated tests may act on real accounts or backend data

Source references: 3
What we found

The Skill tells the agent to “manipulate the application state” through taps and text entry and then persist those paths as repeatable end-to-end tests, without limiting the launched target to an isolated test environment.

Why this matters

If the app is connected to production services, test interactions could repeatedly submit forms, send messages, create orders, or perform any other real action exposed by the tested UI. The exact consequence depends on the flow selected.

What this evidence establishes

The Skill does direct clicks, text entry, scrolling, and repeated end-to-end runs; these could create real business changes if the test app connects to live services. However, the source does not mention accounts, backends, credentials, or production, and interactive launch explicitly targets `lib/main_test.dart`. Risk to real accounts or data therefore depends on project-specific environment configuration not shown here. Users can require test accounts, a sandbox backend, and resettable data.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:34In the instructionsOpen original file
Use the Dart/Flutter MCP server tools to interactively explore and manipulate the application state before writing static tests.- **Launch**: Execute `launch_app` with `target: "lib/main_test.dart"` to start the application and acquire the DTD URI.- **Inspect**: Execute `get_widget_tree` to discover available `Key`s, `Text` nodes, and widget `Type`s.- **Interact**: Execute `tap`, `enter_text`, and `scroll` to simulate user flows.- **Wait**: Always execute `waitFor` or verify state with `get_health` when navigating or triggering animations.- **Troubleshoot Unmounted Widgets**: If a widget is not found in the tree, it may be lazily loaded in a `SliverList` or `ListView`. Execute `scroll` or `scrollIntoView` to force the widget to mount before interacting with it.
Show 2 other places
SKILL.md:80In the instructionsOpen original file
- [ ] **Task Progress: Exploration**  - [ ] Run `launch_app` via MCP.  - [ ] Map the widget tree using `get_widget_tree`.  - [ ] Validate interaction paths using MCP tools (`tap`, `enter_text`).- [ ] **Task Progress: Authoring**  - [ ] Create `integration_test/app_test.dart`.  - [ ] Write test cases using `WidgetTester` APIs.  - [ ] Create `test_driver/integration_test.dart` with `integrationDriver()`.- [ ] **Task Progress: Execution & Feedback Loop**  - [ ] Run `flutter drive --driver=test_driver/integration_test.dart --target=integration_test/app_test.dart`.  - [ ] **Feedback Loop**: Review test output -> If `PumpAndSettleTimedOutException` occurs, check for infinite animations -> If widget not found, add `scrollUntilVisible` -> Re-run test until passing.
SKILL.md:87In the instructionsOpen original file
  - [ ] Create `test_driver/integration_test.dart` with `integrationDriver()`.- [ ] **Task Progress: Execution & Feedback Loop**  - [ ] Run `flutter drive --driver=test_driver/integration_test.dart --target=integration_test/app_test.dart`.  - [ ] **Feedback Loop**: Review test output -> If `PumpAndSettleTimedOutException` occurs, check for infinite animations -> If widget not found, add `scrollUntilVisible` -> Re-run test until passing.

Inside this skill

7 instruction sections

The Skill modifies a Flutter project by adding test dependencies, enabling the Flutter Driver extension in an application entry point, and adding locator Keys to UI widgets.

View source
SKILL.md:22In the instructionsOpen original file
1. Add required development dependencies to `pubspec.yaml`:   ```bash   flutter pub add 'dev:integration_test:{"sdk":"flutter"}'   flutter pub add 'dev:flutter_test:{"sdk":"flutter"}'   ```2. Enable the Flutter Driver extension in your application entry point (typically `lib/main.dart` or a dedicated `lib/main_test.dart`):   - Import `package:flutter_driver/driver_extension.dart`.   - Call `enableFlutterDriverExtension();` before `runApp()`.3. Add `Key` parameters (e.g., `ValueKey('login_button')`) to critical widgets in the application code to ensure reliable targeting during tests.

The Skill directs the agent to launch the app, inspect its widget tree, perform taps, text entry, and scrolling, then turn the explored flow into persistent integration tests and rerun them.

View source
SKILL.md:34In the instructionsOpen original file
Use the Dart/Flutter MCP server tools to interactively explore and manipulate the application state before writing static tests.- **Launch**: Execute `launch_app` with `target: "lib/main_test.dart"` to start the application and acquire the DTD URI.- **Inspect**: Execute `get_widget_tree` to discover available `Key`s, `Text` nodes, and widget `Type`s.- **Interact**: Execute `tap`, `enter_text`, and `scroll` to simulate user flows.- **Wait**: Always execute `waitFor` or verify state with `get_health` when navigating or triggering animations.- **Troubleshoot Unmounted Widgets**: If a widget is not found in the tree, it may be lazily loaded in a `SliverList` or `ListView`. Execute `scroll` or `scrollIntoView` to force the widget to mount before interacting with it.
SKILL.md:83In the instructionsOpen original file
  - [ ] Validate interaction paths using MCP tools (`tap`, `enter_text`).- [ ] **Task Progress: Authoring**  - [ ] Create `integration_test/app_test.dart`.  - [ ] Write test cases using `WidgetTester` APIs.  - [ ] Create `test_driver/integration_test.dart` with `integrationDriver()`.- [ ] **Task Progress: Execution & Feedback Loop**  - [ ] Run `flutter drive --driver=test_driver/integration_test.dart --target=integration_test/app_test.dart`.  - [ ] **Feedback Loop**: Review test output -> If `PumpAndSettleTimedOutException` occurs, check for infinite animations -> If widget not found, add `scrollUntilVisible` -> Re-run test until passing.

The Skill also provides commands for running tests locally, in Chrome, on headless web, and in Firebase Test Lab; the Firebase flow builds and uploads both application and test APKs.

View source
SKILL.md:61In the instructionsOpen original file
**Conditional Execution Targets:**- **If testing on Chrome:** Launch `chromedriver --port=4444` in a separate terminal, then run:  `flutter drive --driver=test_driver/integration_test.dart --target=integration_test/app_test.dart -d chrome`- **If testing headless web:** Run with `-d web-server`.- **If testing on Android (Local):** Run `flutter drive --driver=test_driver/integration_test.dart --target=integration_test/app_test.dart`.- **If testing on Firebase Test Lab (Android):**   1. Build debug APK: `flutter build apk --debug`  2. Build test APK: `./gradlew app:assembleAndroidTest`  3. Upload both APKs to the Firebase Test Lab console.
Start here · InstructionsSKILL.md
flutter-add-integration-test
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:23In the instructionsOpen original file
1. Add required development dependencies to `pubspec.yaml`:   ```bash   flutter pub add 'dev:integration_test:{"sdk":"flutter"}'
Lines read
164
File checksum (to compare versions)
c6ba5fe9b4bf05a89f4c04d5026bb4bd021a32e1d4f1b16339d5a58c88cfa731