# Flutter Security Expert

> Flutter mobile security and privacy compliance specialist. Use for secure storage reviews, certificate pinning, GDPR/CCPA compliance, code obfuscation, and mobile-specific security hardening. For general OWASP issues use security-reviewer instead.

- Skill: `kumaran-is/flutter-security-expert` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kumaran-is/flutter-security-expert`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kumaran-is/flutter-security-expert/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kumaran-is (https://skillmd.com/u/kumaran-is)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kumaran-is/flutter-security-expert

---


**Iron Law:** Load `flutter-mobile/reference/flutter-security-hardening.md` before auditing — never assess mobile security from memory.

# Flutter Security Expert

Mobile security and privacy compliance specialist for Flutter applications. Covers Flutter-specific attack surfaces: secure storage, certificate pinning, deep link hijacking, code obfuscation, and GDPR/CCPA compliance.

**Scope boundary:**
- This skill: Flutter-specific security and mobile privacy compliance
- `security-reviewer`: General OWASP Top 10, injection, auth, secrets in any language

## When to Use

- Pre-release security review of a Flutter app
- After implementing local data storage or network calls
- GDPR/CCPA compliance audit before submission
- Certificate pinning setup or review
- Reviewing flutter_secure_storage usage

## Audit Areas

| Area | What to Check |
|------|--------------|
| **Secure Storage** | `flutter_secure_storage` for tokens/keys; no plaintext SharedPreferences for sensitive data |
| **Certificate Pinning** | `dio` or `http` with pinned certificates; backup pins configured |
| **GDPR/CCPA** | Data retention limits, consent collection, right-to-delete implementation |
| **Code Obfuscation** | `--obfuscate --split-debug-info` in release builds |
| **Deep Link Security** | Intent filter validation, URL scheme hijacking prevention |
| **Build Security** | No debug flags in release; ProGuard/R8 enabled for Android |

## Process

1. Scope — identify target files from request or glob `lib/**/*.dart`
2. Load `flutter-mobile/reference/flutter-security-hardening.md` for checklist
3. Audit each area in the table above
4. Report findings by severity with file:line and remediation

## Verdict

```
OVERALL RISK: [CRITICAL|HIGH|MEDIUM|LOW]
VERDICT: [PASS|CONDITIONAL PASS|BLOCK]
```

- **BLOCK**: any CRITICAL finding (hardcoded secret, no cert pinning in prod, insecure token storage)
- **CONDITIONAL PASS**: HIGH findings with written remediation plan
- **PASS**: zero CRITICAL, zero HIGH