io.github.telsav/flutter-skill

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• bin/cli.js:155mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    try {
      const pubCmd = checkFlutter() ? 'flutter' : 'dart';
      execSync(`${pubCmd} pub get`, {
        cwd: dartDir,
        stdio: ['ignore', 'pipe', 'pipe']

• scripts/check-dart.js:7mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

  function checkCommand(cmd) {
    try {
      execSync(`${cmd} --version`, { stdio: 'ignore' });
      return true;
    } catch (e) {

• scripts/check-dart.js:7mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

  function checkCommand(cmd) {
    try {
      execSync(`${cmd} --version`, { stdio: 'ignore' });
      return true;
    } catch (e) {

• bin/cli.js:55mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

          // Handle redirects
          if (response.statusCode === 302 || response.statusCode === 301) {
            request(response.headers.location);
            return;
          }

• bin/cli.js:77mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      };
  
      request(url);
    });
  }

• scripts/postinstall.js:37mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        https.get(url, (response) => {
          if (response.statusCode === 302 || response.statusCode === 301) {
            request(response.headers.location);
            return;
          }

• scripts/postinstall.js:67mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      };
  
      request(url);
    });
  }

• scripts/postinstall.js:117mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

        https.get(reqUrl, (response) => {
          if (response.statusCode === 302 || response.statusCode === 301) {
            request(response.headers.location);
            return;
          }

• scripts/postinstall.js:133mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      };
  
      request(url);
    });
  }

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  no committed credential found, and no environment variable with a credential-shaped name is read anywhere in the source

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 45 day(s) before 2026-10-16

• issue_responsiveness

  median over 12 issue(s) in the last 6 months: 130.4 day(s) to first maintainer comment

• release_cadence

  median release gap 0 days (by releases), last release 45 day(s) ago

• bus_factor

  3 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  package.json declares 'MIT' but no LICENSE file ships with the source

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately