flutter-deploy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited flutter-deploy (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous Flutter deployment agent. Do NOT ask questions. Detect, build, sign, upload.
TARGET: $ARGUMENTS
If no arguments: deploy all Flutter apps found in the working directory to both platforms on testflight/internal track.
Arguments: [app-name] [ios|android|both] [testflight|production]
============================================================ PHASE 0: PROJECT DISCOVERY ============================================================
Find all Flutter projects:
pubspec.yaml files in the current directory and immediate subdirectoriesandroid/ and ios/ directories existfastlane/Fastfile)android/key.propertiesBuild an app inventory:
| App | Root | Bundle ID (Android) | Bundle ID (iOS) | Fastlane | Signing |
|---|
============================================================ PHASE 1: SIGNING SETUP ============================================================
For iOS deployment, ensure signing is configured:
security find-identity -v -p codesigningsetup-signing.sh in ~/.config/fastlane/ or project root aws secretsmanager get-secret-value --secret-id "deploy/app-store-keys" --query SecretString --output textkey.propertiesIf signing cannot be resolved, skip that platform and report the blocker.
============================================================ PHASE 2: BUILD ============================================================
For each app and platform:
ANDROID:
cd <app_root>
flutter build appbundle --release --build-number=$(date +%s)iOS:
ios/Flutter/Generated.xcconfig: BUILD_NUM=$(date +%s)
sed -i '' "s/FLUTTER_BUILD_NUMBER=.*/FLUTTER_BUILD_NUMBER=$BUILD_NUM/" ios/Flutter/Generated.xcconfigcd <fastlane_dir> && fastlane ios uploadflutter build ipa --release then xcrun altool --upload-appRun builds for different apps in parallel using the Agent tool. iOS and Android for the SAME app can also run in parallel.
============================================================ PHASE 3: UPLOAD ============================================================
ANDROID (if not already uploaded by Fastlane):
fastlane android upload (internal track) or fastlane android promote (production)iOS:
flutter build ipa was used: xcrun altool --upload-app -f <ipa_path> --type ios \
--apiKey <key_id> --apiIssuer <issuer_id>============================================================ PHASE 4: VERIFY & REPORT ============================================================
After all uploads complete:
| App | Platform | Track | Status | Build Number | Version | Notes |
|---|
============================================================ SELF-HEALING VALIDATION (max 1 retry per step) ============================================================
If any build or upload fails:
============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /flutter-deploy — {YYYY-MM-DD}
- Outcome: {SUCCESS | PARTIAL | FAILED}
- Self-healed: {yes — what was healed | no}
- Apps deployed: {list}
- Platforms: {ios | android | both}
- Bottleneck: {phase that struggled or "none"}
- Suggestion: {one-line improvement idea for /evolve, or "none"}============================================================ DO NOT ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.