How do I install the Flutter Security skill?

Run npx skillmds@latest add dhruvanbhalara/flutter-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Flutter Security skill do?

Use when securing local storage with flutter_secure_storage, enforcing AES-256-GCM encryption, or adding biometric authentication gates. It is listed under Security on SkillMD.

Is Flutter Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Flutter Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Flutter Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Flutter Security?

dhruvanbhalara (@dhruvanbhalara) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Flutter Security by dhruvanbhalara — Agent Skill

Name: Flutter Security
Rating: 4.2 (5 reviews)
Author: dhruvanbhalara

File contents

Security & Data Integrity (Architect Level)

AES-256-GCM: Use Authenticated Encryption for all sensitive storage.
Secret Storage: Mandatory use of flutter_secure_storage for encryption keys and master-derived keys.
Key Derivation: Mandate NIST-approved hashing (Argon2id) for master password derivation before local storage encryption and export.
Memory Safety: Strictly clear sensitive variables (passwords, keys) from memory when the operation finishes or the app enters the background.
Clipboard Safety: Mandate programmatic clearing of sensitive data (OTPs, Passwords) after a short duration (30-60s).
Biometric Gate: Mandatory local authentication for any view, export, or destructive action.
Audit Log: All security-sensitive actions should be logged via AppLogger (excluding raw secrets).

Input & API Security

Input Validation: Validate and sanitize all user-facing input fields before processing or storage.
HTTPS Only: All API communication MUST use HTTPS. Consider certificate pinning for sensitive applications.
Token Storage: STRICTLY prohibit storing tokens, API keys, or credentials in source code or public repositories. Use flutter_secure_storage or environment-based injection.

Frequently asked questions

Flutter Security