·
Last changedVersion:
This version passed the hardening gate. Hardening applied 11 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 12. Review findings remaining: 0.
1
1
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
LICENSE | Excessive Agency & Rogue Autonomy | — | Low | Open |
2 findings
Use the go_router package for declarative routing in Flutter. It provides a robust API for complex routing scenarios, deep linking, and nested navigation.
BottomNavigationBar). StatefulShellRoute maintains the state of parallel navigation branches.# fragment from web URLs, essential for clean deep linking across platforms.Follow this workflow to bootstrap a new Flutter application with go_router and configure the root routing mechanism.
go_router dependency.GoRouter configuration.MaterialApp.router.Run the following commands to create the app and add the required routing package:
Run the create step only when starting a new app. In an existing project, go straight to adding the routing package. The URL strategy import in the example below needs the Flutter web plugins package, which ships with the Flutter SDK; declare it in the pubspec as an SDK dependency.
Define a top-level GoRouter instance. Handle authentication or state-based routing using the redirect parameter. Deep links open routes directly, and the redirect also runs for StatefulShellRoute branches, so guard every route that can be reached from outside the app: check the sign in state and send signed out users to a login screen while keeping the requested location.
Treat path parameters from deep links as untrusted input. Check that the id has the expected form before using it in any lookup, and show the error screen when it does not. The error screen should show users only a generic page not found message and log error details only in debug builds.
Configure the native platforms to intercept specific URLs and route them into the Flutter application.
Confirm the domain, package name, team ID and fingerprint with the user, and check that every placeholder value has been replaced in each edited or prepared file. Prepare the two association files for the user to review and deploy; the user publishes them to the domain.
AndroidManifest.xml: Add the intent filter inside the <activity> tag for .MainActivity.assetlinks.json: Serve the following JSON at https://yourdomain.com/.well-known/assetlinks.json.Ask the user to supply the public signing certificate fingerprint, for example from the Play Console app signing page. Use only that public value, and keep keystores and keystore passwords closed and out of logs.
Info.plist: Opt-in to Flutter's default deep link handler.
Note: Before adding this key, check the project dependencies for a third-party deep linking plugin (e.g., app_links). If one is present, set this to NO to prevent conflicts.Runner.entitlements: Add the associated domain.apple-app-site-association: Serve the following JSON (without a .json extension) at https://yourdomain.com/.well-known/apple-app-site-association.Before hosting this file, replace the wildcard in both the paths and components keys with only the path prefixes the app actually routes, and exclude login, sign in callback and password reset pages. On Android, limit the intent filter to the same routes.
Run the tests below -> review errors -> fix. Use only these listed tests, and ask the user to confirm that both association files are reachable on the domain.
xcrun on a booted simulator.
Use StatefulShellRoute to implement persistent UI shells (like a bottom navigation bar) that maintain the state of their child routes.
StatefulShellRoute.indexedStack in the GoRouter configuration.StatefulShellBranch instances for each navigation tab.StatefulNavigationShell.Implement the UI shell that consumes the StatefulNavigationShell to handle branch switching.
Use the context.go() and context.push() extension methods provided by go_router.
Get started with chainctlchainctl skill install public/flutter/flutter-setup-declarative-routing:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/flutter/skills/flutter-setup-declarative-routing:latest
BSD-3-Clause
HARDENING.md
LICENSE
SKILL.md