·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 3.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
LICENSE | Excessive Agency & Rogue Autonomy | — | Low | Open |
1 finding
Configure the environment and platform-specific permissions required for network access.
http package dependency via the terminal:
android/app/src/main/AndroidManifest.xml:
macos/Runner/DebugProfile.entitlements and macos/Runner/Release.entitlements:
Execute HTTP operations and map responses to strongly typed Dart objects.
Uri.parse('your_url').headers parameter map. Use HttpHeaders.authorizationHeader for auth tokens. Load auth tokens at runtime, for example after the user signs in, and keep them in secure platform storage; shipped app binaries can be unpacked, so keep tokens out of source code and source control. Attach credentials only to your own trusted API hosts over secure connections.jsonEncode() from dart:convert.response.statusCode. Treat 200 OK (GET/PUT/DELETE) and 201 CREATED (POST) as success. Other statuses in the two hundred range, such as an empty no content reply, also count as success; leave an empty body undecoded.null on failure, as this prevents FutureBuilder from triggering its error state and causes infinite loading indicators. Show users a generic failure message and log the detailed error for developers; keep response bodies and tokens out of exception text.jsonDecode(response.body) and map it to a custom Dart object using a factory constructor (e.g., fromJson). Treat response JSON as untrusted: catch format and type errors during parsing, rethrow a descriptive exception, and check that required fields exist with the expected types.Offload expensive JSON parsing to a separate Isolate to prevent UI jank (frame drops).
package:flutter/foundation.dart.compute() function to run the parsing logic in a background isolate.compute() is a top-level function or a static method, as closures or instance methods cannot be passed across isolates.Use the following checklist to implement and validate network operations.
Task Progress:
fromJson factory constructor.Future<Model>.'Content-Type': 'application/json; charset=UTF-8' and attach the jsonEncode body.200 OK, or another status in the two hundred range).statusCode and throw an Exception on failure.Future into the UI using FutureBuilder.snapshot.hasData, snapshot.hasError, and default to a CircularProgressIndicator.Image URLs in this example come from the remote response. Check that they use secure connections and point to expected hosts, and show a placeholder when an image fails to load. In production, replace the generic error text shown to users with a friendly failure message and log the detailed error for developers.
Get started with chainctlchainctl skill install public/flutter/flutter-use-http-package:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/flutter/skills/flutter-use-http-package:latest
BSD-3-Clause
HARDENING.md
LICENSE
SKILL.md