/flutter-security

Secure Flutter token/PII storage, build-time secrets, network trust, and release hardening using OWASP Mobile practices. Use for secure storage, secret injection, certificate pinning, jailbreak/root risk, or release builds—not generic form validation, API error handling,

hoangnguyen0403@hoangnguyen0403

GitHub

From plugin

agent-skills-standard

538200 skills1 MCP

Install

$ npx -y skills add hoangnguyen0403/agent-skills-standard --skill flutter-security --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/flutter-security

Context preview

The summary Claude sees to decide when to auto-load this skill.

Secure Flutter token/PII storage, build-time secrets, network trust, and release hardening using OWASP Mobile practices. Use for secure storage, secret injection, certificate pinning, jailbreak/root risk, or release builds—not generic form validation, API error handling,

SKILL.md

flutter-security.SKILL.md

name: flutter-security
description: Secure Flutter token/PII storage, build-time secrets, network trust, and release hardening using OWASP Mobile practices. Use for secure storage, secret injection, certificate pinning, jailbreak/root risk, or release builds—not generic form validation, API error handling, auth-provider setup, or tests of existing security services.
metadata:
  triggers:
    files:
    - 'lib/infrastructure/**'
    - 'pubspec.yaml'
    keywords:
    - secure_storage
    - obfuscate
    - jailbreak
    - pinning
    - PII
    - OWASP

Mobile Security

Priority: P0 (CRITICAL)

Implementation Workflow

1. **Store secrets securely** — Use `flutter_secure_storage` for tokens/PII. Never use `shared_preferences` for sensitive data. 2. **Externalize secrets** — Never store API keys in Dart code. Use `--dart-define` or `.env` files. 3. **Obfuscate releases** — Build `--obfuscate --split-debug-info=./symbols`. Deterrent only — move sensitive logic to backend. 4. **Pin certificates** — `dio_certificate_pinning` for high-security apps to prevent MITM. 5. **Root detection** — `flutter_jailbreak_detection` for root/jailbreak checks in financial/sensitive apps. 6. **Mask PII** — Redact PII (email, phone) from all logs and analytics.

Secure Storage & Release Build Examples

See [implementation examples](references/implementation.md) for secure storage usage and obfuscated release build commands.

Reference & Examples

SSL Pinning & Secure Storage: [references/REFERENCE.md](references/REFERENCE.md).

Anti-Patterns

**No Secrets in SharedPreferences**: Use `flutter_secure_storage` for tokens and PII
**No Hardcoded API Keys**: Use `--dart-define` or secure vaults for all secrets
**No Unobfuscated Releases**: Always build with `--obfuscate --split-debug-info`
**No PII in Logs**: Mask or omit sensitive data from all logs and analytics events