本文へ移動
cccskills
無料GitHub で公開

flutter-security

Secure Flutter token/PII storage, build-time secrets, network trust, and release hardening using OWASP Mobile practices. Use for secure storage, secret injection, certificate pinning, jailbreak/root risk, or release builds—not generic form validation, API error handling, auth-provider setup, or tests of existing security services.

インストール方法を見る

含まれるファイル(5)

  • SKILL.md2.3 KB
  • evals/evals.json2.4 KB
  • references/implementation.md439 B
  • references/network-security.md702 B
  • references/REFERENCE.md394 B

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Mobile Security

Priority: P0 (CRITICAL)

Implementation Workflow

  1. Store secrets securely — Use flutter_secure_storage for tokens/PII. Never use shared_preferences for sensitive data.
  2. Externalize secrets — Never store API keys in Dart code. Use --dart-define or .env files.
  3. Obfuscate releases — Build --obfuscate --split-debug-info=./symbols. Deterrent only — move sensitive logic to backend.
  4. Pin certificates — dio_certificate_pinning for high-security apps to prevent MITM.
  5. Root detection — flutter_jailbreak_detection for root/jailbreak checks in financial/sensitive apps.
  6. Mask PII — Redact PII (email, phone) from all logs and analytics.

Secure Storage & Release Build Examples

See implementation examples for secure storage usage and obfuscated release build commands.

Reference & Examples

SSL Pinning & Secure Storage: references/REFERENCE.md.

Anti-Patterns

  • No Secrets in SharedPreferences: Use flutter_secure_storage for tokens and PII
  • No Hardcoded API Keys: Use --dart-define or secure vaults for all secrets
  • No Unobfuscated Releases: Always build with --obfuscate --split-debug-info
  • No PII in Logs: Mask or omit sensitive data from all logs and analytics events

Related Topics

common/security-standards | layer-based-clean-architecture | performance

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

  • certificate pinning,SSL pinning

Remediation anchors

  • Remediation anchors: root/jailbreak detection, --obfuscate, --split-debug-info

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Upgrade an Android project to Android Gradle Plugin (AGP) 9. Use when migrating to AGP 9, updating Gradle build files, migrating to built-in Kotlin, or adopting the new AGP DSL.

日本語の概要は準備中です。原文の説明を表示しています。

HoangNguyen0403/agent-skills-standard5732026年10月12日 更新

Apply Clean Architecture layering, modularization, and Unidirectional Data Flow in Android projects. Use when setting up project structure, placing code in layers, configuring feature/core modules, or implementing UDF patterns; defer Compose state and ViewModel/StateFlow implementation to their specific skills.

日本語の概要は準備中です。原文の説明を表示しています。

HoangNguyen0403/agent-skills-standard5732026年10月12日 更新

Implement WorkManager and background processing correctly on Android. Use when creating Worker classes, scheduling tasks, choosing between WorkManager and Foreground Services, or setting up Hilt in workers; defer FCM and notification delivery to android-notifications.

日本語の概要は準備中です。原文の説明を表示しています。

HoangNguyen0403/agent-skills-standard5732026年10月12日 更新

Build high-performance declarative UI with Jetpack Compose. Use when writing Composable functions, optimizing recomposition, hoisting state, or working with LazyColumn and side effects; defer deep-link and navigation routing to android-navigation.

日本語の概要は準備中です。原文の説明を表示しています。

HoangNguyen0403/agent-skills-standard5732026年10月12日 更新

Migrate an Android XML View to Jetpack Compose following a structured 10-step workflow. Use when converting XML layouts to Compose, setting up Compose in an existing View-based project, or incrementally adopting Compose.

日本語の概要は準備中です。原文の説明を表示しています。

HoangNguyen0403/agent-skills-standard5732026年10月12日 更新

Write correct coroutine scopes, lifecycle collection, and dispatcher injection in Android production code. Use for suspend functions, coroutine scopes, and dispatcher mechanics; defer ViewModel StateFlow/LiveData architecture, Fragment lifecycle recipes, persistence/notifications, and unit-test recipes to their specific skills.

日本語の概要は準備中です。原文の説明を表示しています。

HoangNguyen0403/agent-skills-standard5732026年10月12日 更新

HoangNguyen0403 のスキルをすべて見る

このスキルの問題を報告する