菜单
Flutter mobile security and privacy compliance specialist. Use for secure storage reviews, certificate pinning, GDPR/CCPA compliance, code obfuscation, and mobile-specific security hardening. For general OWASP issues use security-reviewer instead.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/kumaran-is/claude-code-onboarding --skill flutter-security-expert命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Root-cause-first debugging methodology for any bug, test failure, exception, or unexpected behavior — mandates investigation before proposing fixes. Use when something is broken, not working, crashing, or throwing errors; triggers: debug, error, bug, exception, stack trace, not working, crash.
Browser automation and testing using playwright-cli (stateful Bash CLI for scripted tests — network inspection, console monitoring, screenshots, tracing) and Browser-Use MCP (autonomous agent flows). Use when the user needs to test web apps, debug browser issues, analyze performance, fill forms, run E2E user flows, or inspect network/console activity.
Use when working through a specific problem or decision using a single reasoning framework applied deeply and interactively. Covers First Principles (break assumptions, rebuild from truth), Inversion (guarantee failure, then flip), Regret Minimization (decide from age 80), and Opportunity Cost (make tradeoffs visible). Triggers: "first principles", "inversion", "regret minimization", "opportunity cost", "help me think through", "challenge my assumptions", "what am I giving up", "work backwards from failure", "what would I regret".
基于 SOC 职业分类
正在显示 SKILL.md
| name | flutter-security-expert |
| description | Flutter mobile security and privacy compliance specialist. Use for secure storage reviews, certificate pinning, GDPR/CCPA compliance, code obfuscation, and mobile-specific security hardening. For general OWASP issues use security-reviewer instead. |
| allowed-tools | Bash, Read, Write, Edit, Glob, Grep |
| agent | flutter-security-expert |
| context | fork |
| metadata | {"triggers":"flutter security, secure storage, certificate pinning, GDPR, CCPA, mobile security, flutter hardening, keystore, flutter privacy, flutter release security","related-skills":"flutter-mobile, security-reviewer","domain":"security","role":"specialist","scope":"review","output-format":"report"} |
| last-reviewed | 2026-03-16 |
Iron Law: Load flutter-mobile/reference/flutter-security-hardening.md before auditing — never assess mobile security from memory.
Mobile security and privacy compliance specialist for Flutter applications. Covers Flutter-specific attack surfaces: secure storage, certificate pinning, deep link hijacking, code obfuscation, and GDPR/CCPA compliance.
Scope boundary:
security-reviewer: General OWASP Top 10, injection, auth, secrets in any language| Area | What to Check |
|---|---|
| Secure Storage | flutter_secure_storage for tokens/keys; no plaintext SharedPreferences for sensitive data |
| Certificate Pinning | dio or http with pinned certificates; backup pins configured |
| GDPR/CCPA | Data retention limits, consent collection, right-to-delete implementation |
| Code Obfuscation | --obfuscate --split-debug-info in release builds |
| Deep Link Security | Intent filter validation, URL scheme hijacking prevention |
| Build Security | No debug flags in release; ProGuard/R8 enabled for Android |
lib/**/*.dartflutter-mobile/reference/flutter-security-hardening.md for checklistOVERALL RISK: [CRITICAL|HIGH|MEDIUM|LOW]
VERDICT: [PASS|CONDITIONAL PASS|BLOCK]