Skip to content
Report library
Purpose / Data analysis

Flutter Use Http Package Skill Security Audit

What the author says it does (original text)

Use the `http` package to execute GET, POST, PUT, or DELETE requests. Use when you need to fetch from or send data to a REST API.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

The example can send a real Bearer token to a third-party demonstration server

Source references: 2
What we found

The example places an Authorization header on a request to the fixed `jsonplaceholder.typicode.com` host and invites replacement of `your_token_here`. If a user replaces only the placeholder without changing the endpoint to a trusted API, the credential is sent to that third party.

Why this matters

The third party could obtain the token and use it against the associated account or API while it remains valid and authorized. The token would also remain directly embedded in application source and build artifacts.

This is example code, but it combines an Authorization header with a fixed third-party demo domain in an actual request. The placeholder is not itself a secret; exposure occurs only if a user replaces it with a real token without changing the URL to the trusted API for that token. The user can ask the author to omit authentication from the demo request or explicitly require the token and API host to match.

SKILL.md:43In the instructionsOpen original file
*   **URIs:** Always parse URL strings using `Uri.parse('your_url')`.*   **Headers:** Inject authorization and content-type headers via the `headers` parameter map. Use `HttpHeaders.authorizationHeader` for auth tokens.*   **Payloads:** For POST and PUT requests, encode the body using `jsonEncode()` from `dart:convert`.*   **Status Validation:** Evaluate `response.statusCode`. Treat `200 OK` (GET/PUT/DELETE) and `201 CREATED` (POST) as success. 
Show 1 other places
SKILL.md:94In the instructionsOpen original file
// 2. Network execution with background parsingFuture<List<Photo>> fetchPhotos() async {  final response = await http.get(    Uri.parse('https://jsonplaceholder.typicode.com/photos'),    headers: {      HttpHeaders.authorizationHeader: 'Bearer your_token_here',      HttpHeaders.acceptHeader: 'application/json',    },  );
Medium risk

Unvalidated remote image URLs can trigger requests to arbitrary hosts

Source references: 3
What we found

A `thumbnailUrl` from the API response is stored and passed directly to `Image.network`, without restricting its scheme or host. A party controlling the API response can make clients contact an image server of its choice.

Why this matters

That server can observe the user's IP address, request timing, and ordinary network metadata. Numerous or oversized image responses could also consume bandwidth and memory.

The example stores thumbnailUrl directly from the response and passes it to Image.network without restricting its scheme or host. A party able to control or alter the API response could therefore make the client contact a chosen image host, enabling IP/request-metadata disclosure, tracking, or attempts to reach client-accessible internal addresses. The cited code does not show the Bearer token being attached to image requests. The user can ask for HTTPS-only URLs and an approved image-host allowlist.

SKILL.md:123In the instructionsOpen original file
  factory Photo.fromJson(Map<String, dynamic> json) {    return Photo(      id: json['id'] as int,      title: json['title'] as String,      thumbnailUrl: json['thumbnailUrl'] as String,    );  }
Show 2 other places
SKILL.md:157In the instructionsOpen original file
          final photos = snapshot.data!;          return ListView.builder(            itemCount: photos.length,            itemBuilder: (context, index) => ListTile(              leading: Image.network(photos[index].thumbnailUrl),              title: Text(photos[index].title),            ),          );
SKILL.md:155In the instructionsOpen original file
      builder: (context, snapshot) {        if (snapshot.hasData) {          final photos = snapshot.data!;          return ListView.builder(            itemCount: photos.length,            itemBuilder: (context, index) => ListTile(              leading: Image.network(photos[index].thumbnailUrl),              title: Text(photos[index].title),            ),
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill instructs the project to install Flutter's `http` dependency and enable outbound networking on Android and macOS. These permissions match its REST API purpose, but give the application the ability to contact external servers.

View source
SKILL.md:21In the instructionsOpen original file
1. Add the `http` package dependency via the terminal:   ```bash   flutter pub add http   ```2. Import the package in your Dart files:
SKILL.md:29In the instructionsOpen original file
   ```3. Configure Android permissions by adding the Internet permission to `android/app/src/main/AndroidManifest.xml`:   ```xml   <uses-permission android:name="android.permission.INTERNET" />   ```4. Configure macOS entitlements by adding the network client key to both `macos/Runner/DebugProfile.entitlements` and `macos/Runner/Release.entitlements`:   ```xml   <key>com.apple.security.network.client</key>   <true/>   ```

The networking example makes a GET request to a fixed third-party demonstration domain and sends an Authorization header with it. The code block is an example rather than an automatically executed script, but copying it and inserting a real token would create an actual disclosure path.

View source
SKILL.md:93In the instructionsOpen original file
// 2. Network execution with background parsingFuture<List<Photo>> fetchPhotos() async {  final response = await http.get(    Uri.parse('https://jsonplaceholder.typicode.com/photos'),    headers: {      HttpHeaders.authorizationHeader: 'Bearer your_token_here',      HttpHeaders.acceptHeader: 'application/json',    },  );

The example trusts the API-supplied `thumbnailUrl` and then causes `Image.network` to make a second network request to that address, so contacted hosts are not limited to the initial API.

View source
SKILL.md:123In the instructionsOpen original file
  factory Photo.fromJson(Map<String, dynamic> json) {    return Photo(      id: json['id'] as int,      title: json['title'] as String,      thumbnailUrl: json['thumbnailUrl'] as String,    );  }
SKILL.md:157In the instructionsOpen original file
          final photos = snapshot.data!;          return ListView.builder(            itemCount: photos.length,            itemBuilder: (context, index) => ListTile(              leading: Image.network(photos[index].thumbnailUrl),              title: Text(photos[index].title),            ),          );
Start here · InstructionsSKILL.md
flutter-use-http-package
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:3In the instructionsOpen original file
name: flutter-use-http-packagedescription: Use the `http` package to execute GET, POST, PUT, or DELETE requests. Use when you need to fetch from or send data to a REST API.metadata:
SKILL.md:96In the instructionsOpen original file
  final response = await http.get(    Uri.parse('https://jsonplaceholder.typicode.com/photos'),    headers: {
Run commands
SKILL.md:22In the instructionsOpen original file
1. Add the `http` package dependency via the terminal:   ```bash   flutter pub add http
Lines read
175
File checksum (to compare versions)
f51a6c27957ad014a0fee4dac2675044989d31ae8c2b9dddbc20ff2d4402ecb2