# static-security

> Claude/Codex skill by [@verygoodopensource](https://omgskills.com/library/verygoodopensource/index.md) · 173 stars · Updated 2026-10-20

Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies. Use when reviewing or writing code handling secrets, user data, network communication, authentication, or cryptography, or adding validation to user input in login, sign-up, or payment forms before it reaches a repository or an API. Also when asked to implement the insecure change rather than review it: moving an API key to --dart-define, String.fromEnvironment, a .env file, or CI secrets, or "our reviewer flagged this line". Also for dependency vulnerability review and security audits that never say "security": whether a pubspec is safe to release, checking dependencies for known vulnerabilities or CVEs, an ignored\_advisories entry, or pinned versions we're exposed to.

Tags: a11y, ai, best-practices, bloc, claude-code, dart, flutter, i18n, l10n, plugin, skills, state-management, testing, very-good-analysis, very-good-cli

## Install

```sh
git clone https://github.com/VeryGoodOpenSource/vgv-ai-flutter-plugin /tmp/vgv-ai-flutter-plugin && ln -s /tmp/vgv-ai-flutter-plugin/skills/static-security ~/.claude/skills/static-security
```

## From README

Security Flutter apps compile all Dart code directly into a binary that runs on untrusted devices. This skill covers static security review for Flutter/Dart codebases, anchored to the VGV Security in Mobile Apps guide and the OWASP Mobile Top 10. Every finding in this skill is something detectable by reading source code — no pen-testing or runtime analysis. Core Standards Apply these standards to all Flutter security work: Never hardcode secrets — API keys, tokens, and passwords in source code or config files are compiled into the binary and extractable via reverse engineering; serve them from a backend service --dart-define is not a fix for a hardcoded secret — neither is String.fromEnvironment, a .env file, a native config file, an obfuscated constant, or a split-up string. Every one of them still ships the value inside the binary in recoverable form, so moving a key into one is the same finding in a new location.

## Links

- HTML page: https://omgskills.com/library/verygoodopensource/vgv-ai-flutter-plugin/skills/static-security/
- GitHub: https://github.com/VeryGoodOpenSource/vgv-ai-flutter-plugin
- Author: [@verygoodopensource](https://omgskills.com/library/verygoodopensource/index.md)

## More from this repo

- [accessibility](https://omgskills.com/library/verygoodopensource/vgv-ai-flutter-plugin/skills/accessibility/index.md) — Audits or remediates Flutter widgets against WCAG 2.2 conformance levels A, AA, or AAA across iOS, Android, Web, macOS,...
   - [@verygoodopensource](https://omgskills.com/library/verygoodopensource/index.md) · 173 stars
- [animations](https://omgskills.com/library/verygoodopensource/vgv-ai-flutter-plugin/skills/animations/index.md) — Best practices for Flutter animations using the built-in animation framework, covering implicit animations, explicit...
   - [@verygoodopensource](https://omgskills.com/library/verygoodopensource/index.md) · 173 stars
- [bloc](https://omgskills.com/library/verygoodopensource/vgv-ai-flutter-plugin/skills/bloc/index.md) — Best practices for Bloc state management in Flutter/Dart, covering Cubit versus Bloc, event and state naming, sealed...
   - [@verygoodopensource](https://omgskills.com/library/verygoodopensource/index.md) · 173 stars