How do I install the Flutter Security skill?

Run npx skillmds@latest add tomevault-io/flutter-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Flutter Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Flutter Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Flutter Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Flutter Security?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Flutter Security by tomevault-io — Agent Skill

Name: Flutter Security
Author: tomevault-io

Flutter Security

Enforce architect-level security standards including AES-256-GCM encryption, secure storage, biometric gates, and memory safety. Use when handling sensitive data, credentials, clipboard content, or API communication security. Use when this capability is needed.

tomevault-io 99d2d6d 2 files · 2.4 KB Updated Sep 17, 2026

File contents

Security & Data Integrity (Architect Level)

AES-256-GCM: Use Authenticated Encryption for all sensitive storage.
Secret Storage: Mandatory use of flutter_secure_storage for encryption keys and master-derived keys.
Key Derivation: Mandate NIST-approved hashing (Argon2id) for master password derivation before local storage encryption and export.
Memory Safety: Strictly clear sensitive variables (passwords, keys) from memory when the operation finishes or the app enters the background.
Clipboard Safety: Mandate programmatic clearing of sensitive data (OTPs, Passwords) after a short duration (30-60s).
Biometric Gate: Mandatory local authentication for any view, export, or destructive action.
Audit Log: All security-sensitive actions should be logged via AppLogger (excluding raw secrets).

Input & API Security

Input Validation: Validate and sanitize all user-facing input fields before processing or storage.
HTTPS Only: All API communication MUST use HTTPS. Consider certificate pinning for sensitive applications.
Token Storage: STRICTLY prohibit storing tokens, API keys, or credentials in source code or public repositories. Use flutter_secure_storage or environment-based injection.

Source: dhruvanbhalara/skills — distributed by TomeVault.

Frequently asked questions