Skip to content
skillsafebeta
← Report library
Purpose / Browser automation

Flutter Setup Declarative Routing Skill Security Audit

What the author says it does (original text)

Configure `MaterialApp.router` using a package like `go_router` for advanced URL-based navigation. Use when developing web applications or mobile apps that require specific deep linking and browser history support.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

The example associates the app with every URL on the domain

Source references: 5
What we found

The Android association requests handle_all_urls and its intent filter has no path restriction; the iOS AASA uses both “*” and “/*” wildcard paths. Copied into production, the app claims substantially more links than the example details route.

Why this matters

If the domain also hosts sign-in, payment, administration, or other product pages, those links may be routed into the app unintentionally. Unsupported paths or parameters could lead users into incorrect flows or decisions based on an unintended deep link.

The source supports this risk. If a user substitutes the placeholders and deploys these association files as written, Android requests handling of all URLs for the app/domain and its intent filter has no path restriction; the iOS configuration also uses all-path wildcards. This could make the app claim links beyond the intended details page. Users can ask the author to scope the Android filter and both association files to required paths and justify any domain-wide association.

SKILL.md:102In the instructionsOpen original file
```xml<intent-filter android:autoVerify="true">    <action android:name="android.intent.action.VIEW" />    <category android:name="android.intent.category.DEFAULT" />    <category android:name="android.intent.category.BROWSABLE" />    <data android:scheme="http" android:host="yourdomain.com" />    <data android:scheme="https" /></intent-filter>```
Show 4 other places
SKILL.md:112In the instructionsOpen original file
```json[{  "relation": ["delegate_permission/common.handle_all_urls"],  "target": {    "namespace": "android_app",    "package_name": "com.yourcompany.yourapp",    "sha256_cert_fingerprints": ["YOUR_SHA256_FINGERPRINT"]  }}]```
SKILL.md:138In the instructionsOpen original file
```json{  "applinks": {    "apps": [],    "details": [{      "appIDs": ["TEAM_ID.com.yourcompany.yourapp"],      "paths": ["*"],      "components": [{"/": "/*"}]    }]  }}```
SKILL.md:113In the instructionsOpen original file
[{  "relation": ["delegate_permission/common.handle_all_urls"],  "target": {    "namespace": "android_app",    "package_name": "com.yourcompany.yourapp",    "sha256_cert_fingerprints": ["YOUR_SHA256_FINGERPRINT"]  }
SKILL.md:141In the instructionsOpen original file
    "apps": [],    "details": [{      "appIDs": ["TEAM_ID.com.yourcompany.yourapp"],      "paths": ["*"],      "components": [{"/": "/*"}]    }]  }
Medium risk

The Android configuration explicitly accepts unencrypted HTTP deep links

Source references: 2
What we found

The Android intent filter registers both http and https for external URLs entering the app. HTTP provides neither transport encryption nor authenticated server identity.

Why this matters

When a user opens an HTTP deep link on an untrusted network, its path and query parameters may be observed or altered before reaching the intended site, potentially opening an attacker-selected app route. Risk is greater if links contain sensitive or decision-driving values.

The activity intent-filter explicitly includes `http` and is presented as a way to intercept external URLs. If copied, Android can deliver matching plaintext HTTP links to the app; unlike HTTPS, their path or query data lacks transport confidentiality and authenticated server protection and may be observed or altered. The source does not show the app fetching data over HTTP, so the risk is limited to deep-link contents. Users can require HTTPS-only links unless a documented legacy need exists.

SKILL.md:102In the instructionsOpen original file
```xml<intent-filter android:autoVerify="true">    <action android:name="android.intent.action.VIEW" />    <category android:name="android.intent.category.DEFAULT" />    <category android:name="android.intent.category.BROWSABLE" />    <data android:scheme="http" android:host="yourdomain.com" />    <data android:scheme="https" /></intent-filter>```
Show 1 other places
SKILL.md:91In the instructionsOpen original file
Configure the native platforms to intercept specific URLs and route them into the Flutter application.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill instructs the agent to create a Flutter application, install go_router, and bind GoRouter to MaterialApp.router; following these steps creates a project and introduces a third-party dependency.

View source
SKILL.md:37In the instructionsOpen original file
### 1. Scaffold the ApplicationRun the following commands to create the app and add the required routing package:```bashflutter create <app-name>cd <app-name>flutter pub add go_router```
SKILL.md:79In the instructionsOpen original file
  @override  Widget build(BuildContext context) {    return MaterialApp.router(      routerConfig: _router,      title: 'Routing App',    );  }

The Skill also calls for modifying Android and iOS app-association settings and publishing association files on a controlled domain so matching web links can open the application directly.

View source
SKILL.md:99In the instructionsOpen original file
### If configuring for Android:1. **Modify `AndroidManifest.xml`**: Add the intent filter inside the `<activity>` tag for `.MainActivity`.```xml<intent-filter android:autoVerify="true">    <action android:name="android.intent.action.VIEW" />    <category android:name="android.intent.category.DEFAULT" />    <category android:name="android.intent.category.BROWSABLE" />    <data android:scheme="http" android:host="yourdomain.com" />    <data android:scheme="https" /></intent-filter>```2. **Host `assetlinks.json`**: Serve the following JSON at `https://yourdomain.com/.well-known/assetlinks.json`.```json
SKILL.md:129In the instructionsOpen original file
```2. **Modify `Runner.entitlements`**: Add the associated domain.```xml<key>com.apple.developer.associated-domains</key><array>  <string>applinks:yourdomain.com</string></array>```3. **Host `apple-app-site-association`**: Serve the following JSON (without a `.json` extension) at `https://yourdomain.com/.well-known/apple-app-site-association`.```json
Start here · InstructionsSKILL.md
flutter-setup-declarative-routing
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:39In the instructionsOpen original file
Run the following commands to create the app and add the required routing package:```bashflutter create <app-name>
SKILL.md:153In the instructionsOpen original file
- **Android**: Test using ADB.  ```bash  adb shell 'am start -a android.intent.action.VIEW -c android.intent.category.BROWSABLE -d "https://yourdomain.com/details/123"' com.yourcompany.yourapp
SKILL.md:157In the instructionsOpen original file
- **iOS**: Test using `xcrun` on a booted simulator.  ```bash  xcrun simctl openurl booted https://yourdomain.com/details/123
Connect to websites
SKILL.md:110In the instructionsOpen original file
```2. **Host `assetlinks.json`**: Serve the following JSON at `https://yourdomain.com/.well-known/assetlinks.json`.```json
SKILL.md:136In the instructionsOpen original file
```3. **Host `apple-app-site-association`**: Serve the following JSON (without a `.json` extension) at `https://yourdomain.com/.well-known/apple-app-site-association`.```json
SKILL.md:154In the instructionsOpen original file
  ```bash  adb shell 'am start -a android.intent.action.VIEW -c android.intent.category.BROWSABLE -d "https://yourdomain.com/details/123"' com.yourcompany.yourapp  ```
Lines read
256
File checksum (to compare versions)
49456d82726e8b758a78418d70fa6f6f86c970c4e5b185889e42a7093ec1acc5