Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

sqflite-common-ffi-async-test-suite

skill:tekartik/sqflite#sqflite-common-ffi-async-test-suite

Use when testing package:sqflite_common_ffi_async (the sqlite_async based sqflite DatabaseFactory) against the shared sqflite suite with sqflite_common_ffi_async_test: runFfiAsyncTests(context), the all: true full-suite switch, building the SqfliteTestContext (SqfliteLocalTestContext, supportsConcurrentRead, supportsUri), databaseFactoryFfiAsync / databaseFactoryFfiAsyncTest, which sqflite_common_test suites are known to pass or fail, and @TestOn('vm').

SkillsMP
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:26 UTC at 52dbf98

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

1
findings
medium
highest severity
1
threat classes
789
files scanned
24/24
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:packages/sqflite_common_ffi_async_test/skills/sqflite-common-ffi-async-test-suite:packages/sqflite_common_ffi_async_test/skills/sqflite-common-ffi-async-test-suite/SKILL.md:27:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill instructs adding dev_dependencies resolved from the mutable git URL github.com/tekartik/sqflite with no pinned ref, so the test-runner code consumed at build time can change between builds.

packages/sqflite_common_ffi_async_test/skills/sqflite-common-ffi-async-test-suite/SKILL.md:27-31
url: https://github.com/tekartik/sqflite
vector:instruction
Counter-argument considered

The verbatim yaml block shows git dev_dependencies resolved from github.com/tekartik/sqflite with no ref pin exactly as claimed, and no carve-out applies (the install is neither pinned nor from an official registry, and the `version: '>=0.3.0'` constraint is not a ref pin) nor any artifact mitigation, so the supply-chain mutability claim stands; the setup is openly declared (D2), which fails the undeclared gate, but disclosure alone does not neutralize a supply-chain risk.

Open questions 4

What the analysis could not settle from the code alone.

[invalid file request] Does the sqflite-common-test-suite SKILL.md contain any instructions beyond enumerating the shared test suites, such as agent directives, auto-run steps, or network calls?
Agent hijacking
[invalid file request] Does runFfiAsyncTests / all_test.dart only declare the documented sqflite_common_test suites, or does it add network access, credential access, or file writes beyond the declared test-databases path?
Code execution
[file request sqflite_common_test/skills/sqflite-common-test-suite/SKILL.md] The guidelines tell the agent to 'see the sqflite-common-test-suite skill for the full list' of shared suites; does that referenced skill contain any instructions beyond enumerating the shared test suites (e.g. agent directives, auto-run steps, or network calls)?
Agent hijacking
[file request packages/sqflite_common_ffi_async_test/lib/all_test.dart] Does runFfiAsyncTests / all_test.dart only declare the documented sqflite_common_test suites, or does it add any network access, credential access, or file writes beyond the declared test-databases path?
Code execution

Coverage gaps 6

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
packages_flutter/sqflite_example_common/assets/example.db
context:unanalyzable_binary binary content is only byte-scanned
packages_flutter/sqflite_example_common/assets/issue_64.db
context:unanalyzable_binary binary content is only byte-scanned
packages_web/sqflite_test_app_web/assets/example.db
context:unanalyzable_binary binary content is only byte-scanned
packages_web/sqflite_test_app_web/assets/issue_64.db
invalid_judge_finding request.0
request_unanswered request.0: invalid file request (evidence_ids not shown in the asking request)