How do I install the Flutter Security skill?

Run npx skillmds@latest add hoangnguyen0403/flutter-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Flutter Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Flutter Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Flutter Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Flutter Security?

HoangNguyen0403 (@hoangnguyen0403) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Flutter Security by hoangnguyen0403

Name: Flutter Security
Rating: 4.2 (5 reviews)
Author: HoangNguyen0403

Flutter Security

Secure Flutter token/PII storage, build-time secrets, network trust, and release hardening using OWASP Mobile practices. Use for secure storage, secret injection, certificate pinning, jailbreak/root risk, or release builds—not generic form validation, API error handling, auth-provider setup, or tests of existing security services.

HoangNguyen0403 Updated Sep 9, 2026 542 repo stars

File contents

Mobile Security

Priority: P0 (CRITICAL)

Implementation Workflow

Store secrets securely — Use flutter_secure_storage for tokens/PII. Never use shared_preferences for sensitive data.
Externalize secrets — Never store API keys in Dart code. Use --dart-define or .env files.
Obfuscate releases — Build --obfuscate --split-debug-info=./symbols. Deterrent only — move sensitive logic to backend.
Pin certificates — dio_certificate_pinning for high-security apps to prevent MITM.
Root detection — flutter_jailbreak_detection for root/jailbreak checks in financial/sensitive apps.
Mask PII — Redact PII (email, phone) from all logs and analytics.

Secure Storage & Release Build Examples

See implementation examples for secure storage usage and obfuscated release build commands.

Reference & Examples

SSL Pinning & Secure Storage: references/REFERENCE.md.

Anti-Patterns

No Secrets in SharedPreferences: Use flutter_secure_storage for tokens and PII
No Hardcoded API Keys: Use --dart-define or secure vaults for all secrets
No Unobfuscated Releases: Always build with --obfuscate --split-debug-info
No PII in Logs: Mask or omit sensitive data from all logs and analytics events

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

certificate pinning,SSL pinning

Remediation anchors

Remediation anchors: root/jailbreak detection, --obfuscate, --split-debug-info

---name: flutter-securitydescription: Secure Flutter token/PII storage, build-time secrets, network trust, and release hardening using OWASP Mobile practices. Use for secure storage, secret injection, certificate pinning, jailbreak/root risk, or release builds—not generic form validation, API error handling, auth-provider setup, or tests of existing security services.--- # Mobile Security ## **Priority: P0 (CRITICAL)** ## Implementation Workflow 1. **Store secrets securely** — Use `flutter_secure_storage` for tokens/PII. Never use `shared_preferences` for sensitive data. 2. **Externalize secrets** — Never store API keys in Dart code. Use `--dart-define` or `.env` files. 3. **Obfuscate releases** — Build `--obfuscate --split-debug-info=./symbols`. Deterrent only — move sensitive logic to backend. 4. **Pin certificates** — `dio_certificate_pinning` for high-security apps to prevent MITM. 5. **Root detection** — `flutter_jailbreak_detection` for root/jailbreak checks in financial/sensitive apps. 6. **Mask PII** — Redact PII (email, phone) from all logs and analytics. ### Secure Storage & Release Build Examples See [implementation examples](references/implementation.md) for secure storage usage and obfuscated release build commands. ## Reference & Examples SSL Pinning & Secure Storage: [references/REFERENCE.md](references/REFERENCE.md). ## Anti-Patterns - **No Secrets in SharedPreferences**: Use `flutter_secure_storage` for tokens and PII - **No Hardcoded API Keys**: Use `--dart-define` or secure vaults for all secrets - **No Unobfuscated Releases**: Always build with `--obfuscate --split-debug-info` - **No PII in Logs**: Mask or omit sensitive data from all logs and analytics events ## Related Topics common/security-standards | layer-based-clean-architecture | performance ## Canonical response anchors When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant: - certificate pinning,SSL pinning ## Remediation anchors - Remediation anchors: root/jailbreak detection, --obfuscate, --split-debug-info

Frequently asked questions