static-security
Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies. Use when reviewing or writing code handling secrets, user data, network communication, authentication, or cryptography, or adding validation to user input in login, sign-up, or payment forms before it reaches a repository or an API. Also when asked to implement the insecure change rather than review it: moving an API key to --dart-define, String.fromEnvironment, a .env file, or CI secrets, or "our reviewer flagged this line". Also for dependency vulnerability review and security audits that never say "security": whether a pubspec is safe to release, checking dependencies for known vulnerabilities or CVEs, an ignored_advisories entry, or pinned versions we're exposed to.
Install
With your agent
Install OMGSkills skill "verygoodopensource/vgv-ai-flutter-plugin:skills/static-security" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/VeryGoodOpenSource/vgv-ai-flutter-plugin /tmp/vgv-ai-flutter-plugin && ln -s /tmp/vgv-ai-flutter-plugin/skills/static-security ~/.claude/skills/static-securityFrom README
Security Flutter apps compile all Dart code directly into a binary that runs on untrusted devices. This skill covers static security review for Flutter/Dart codebases, anchored to the VGV Security in Mobile Apps guide and the OWASP Mobile Top 10. Every finding in this skill is something detectable by reading source code — no pen-testing or runtime analysis. Core Standards Apply these standards to all Flutter security work: Never hardcode secrets — API keys, tokens, and passwords in source code or config files are compiled into the binary and extractable via reverse engineering; serve them from a backend service --dart-define is not a fix for a hardcoded secret — neither is String.fromEnvironment, a .env file, a native config file, an obfuscated constant, or a split-up string. Every one of them still ships the value inside the binary in recoverable form, so moving a key into one is the same finding in a new location.
More from this repo
accessibility
Audits or remediates Flutter widgets against WCAG 2.2 conformance levels A, AA, or AAA across iOS, Android, Web, macOS,...
animations
Best practices for Flutter animations using the built-in animation framework, covering implicit animations, explicit...
bloc
Best practices for Bloc state management in Flutter/Dart, covering Cubit versus Bloc, event and state naming, sealed...