Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Flutter Add Widget Test Skill Security Audit

What the author says it does (original text)

Implement a component-level test using `WidgetTester` to verify UI rendering and user interactions (tapping, scrolling, entering text). Use when validating that a specific widget displays correct data and responds to events as expected.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Failed tests may lead to changes in production widget logic

Source references: 3
What we found

Although the stated purpose is to implement component tests, the feedback loop explicitly permits adjusting widget logic to make tests pass. It does not require confirming that the failure is a product defect or confine changes to test files.

Why this matters

An agent could change application behavior under `lib/` when the user requested only a test. This may hide a faulty test, alter the real UI or interactions, and create persistent changes beyond the user's authorization.

The Skill is presented as implementing component-level tests, but its failure loop permits “adjust widget logic or test assertions.” If the agent assumes a failure is a component defect, it could change production code such as files under lib/, altering application behavior rather than only adding tests. A user can require test/-only changes by default and explicit approval, with evidence of a product defect, before widget logic is changed.

SKILL.md:46In the instructionsOpen original file
- [ ] **Step 8: Run and validate.** Execute `flutter test test/your_test_file_test.dart`.- [ ] **Step 9: Feedback Loop.** Review test output -> identify failing matchers -> adjust widget logic or test assertions -> re-run until passing.
Show 2 other places
SKILL.md:3In the instructionsOpen original file
name: flutter-add-widget-testdescription: Implement a component-level test using `WidgetTester` to verify UI rendering and user interactions (tapping, scrolling, entering text). Use when validating that a specific widget displays correct data and responds to events as expected.metadata:
SKILL.md:45In the instructionsOpen original file
- [ ] **Step 7: Verify updated state.** Use `expect()` to validate the UI after the interaction.- [ ] **Step 8: Run and validate.** Execute `flutter test test/your_test_file_test.dart`.- [ ] **Step 9: Feedback Loop.** Review test output -> identify failing matchers -> adjust widget logic or test assertions -> re-run until passing.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill instructs the agent to add the `flutter_test` development dependency and create test files under the Flutter project's root `test/` directory.

View source
SKILL.md:21In the instructionsOpen original file
1. Add the `flutter_test` dependency to the `dev_dependencies` section of `pubspec.yaml`.2. Place all test files in the `test/` directory at the root of the project.3. Suffix all test file names with `_test.dart` (e.g., `widget_test.dart`).

The testing workflow renders a widget, locates UI elements, simulates interactions, waits for state updates, and asserts the UI state before and after interaction.

View source
SKILL.md:38In the instructionsOpen original file
### Task Progress- [ ] **Step 1: Define the test.** Use `testWidgets('description', (WidgetTester tester) async { ... })`.- [ ] **Step 2: Build the widget.** Call `await tester.pumpWidget(MyWidget())` to render the UI. Wrap the widget in a `MaterialApp` or `Directionality` widget if it requires inherited directional or theme data.- [ ] **Step 3: Locate elements.** Instantiate `Finder` objects for the target widgets.- [ ] **Step 4: Verify initial state.** Use `expect(finder, matcher)` to validate the initial render.- [ ] **Step 5: Simulate interactions.** Execute gestures or inputs (e.g., `await tester.tap(buttonFinder)`).- [ ] **Step 6: Rebuild the tree.** Call `await tester.pump()` or `await tester.pumpAndSettle()` to process state changes.- [ ] **Step 7: Verify updated state.** Use `expect()` to validate the UI after the interaction.- [ ] **Step 8: Run and validate.** Execute `flutter test test/your_test_file_test.dart`.

The Skill directs the agent to execute a targeted Flutter test command and iterate based on failures.

View source
SKILL.md:45In the instructionsOpen original file
- [ ] **Step 7: Verify updated state.** Use `expect()` to validate the UI after the interaction.- [ ] **Step 8: Run and validate.** Execute `flutter test test/your_test_file_test.dart`.- [ ] **Step 9: Feedback Loop.** Review test output -> identify failing matchers -> adjust widget logic or test assertions -> re-run until passing.
Start here · InstructionsSKILL.md
flutter-add-widget-test
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
155
File checksum (to compare versions)
bf997b3debc77cc992b332b3ffc6909a2415a682ae87a007e024cad05a0a85eb