Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ariaramin/flutter-skills --skill flutter-webview-production-engineeringgit clone --depth 1 https://github.com/ariaramin/flutter-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ariaramin/flutter-skills/flutter-webview-production-engineering)<a href="https://agentmods.dev/skills/ariaramin/flutter-skills/flutter-webview-production-engineering"><img src="https://agentmods.dev/badge/skills/ariaramin/flutter-skills/flutter-webview-production-engineering/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ariaramin/flutter-skills/flutter-webview-production-engineering"><img src="https://agentmods.dev/badge/skills/ariaramin/flutter-skills/flutter-webview-production-engineering.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.04822 |
| Opus 5.5 | $0.00046 | $0.01929 |
| Sonnet 5.5 | $0.00023 | $0.00964 |
| Haiku 4.5 | $0.00012 | $0.00482 |
Grade A, and why
flutter-webview-production-engineering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 480 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flutter WebView Production Engineering
Treat a WebView as a heavyweight platform-owned browser runtime and a security boundary, not as an ordinary Flutter widget. A production flow must reason about three systems at once:
Flutter application
↕
platform WebView integration
↕
web/browser runtime + page
Optimize and secure the complete pipeline rather than only the Dart wrapper.
Reference routing
Read only what the task needs:
| Need | Reference |
|---|---|
| Package fit, controller lifecycle, platform views, URL loading, navigation policy | references/01-lifecycle-platform-views-navigation.md |
| HTTPS/TLS, JavaScript, bridge protocol, cookies, auth, storage, networking | references/02-web-security-session-bridge.md |
| Loading/error UX, SPA/back, gestures, platform APIs, media, permissions, uploads/downloads | references/03-browser-ux-platform-capabilities.md |
| Memory/startup/page performance, offline, security/privacy, accessibility, state architecture | references/04-performance-security-architecture.md |
| Web boundary, capability tables, tests, profiling, audits, migration, release gates | references/05-platform-testing-migration-checklists.md |
1. Decide whether WebView is justified
Before adding a WebView, answer: Answer before coding: Why must the content remain embedded; Could Flutter render it more safely and accessibly; Could the system browser be a better trust boundary; Is authentication involved; Does the provider allow embedded user agents; Which origins may load; Is JavaScript required; Does the page need native app capabilities; Which camera/microphone/location/file permissions are required; How many simultaneous browser instances can exist; What is the lifecycle when hidden, backgrounded, logged out, or closed; Is Flutter web also a target. Prefer:
native product UI → Flutter widgets
first-party embedded web app → webview_flutter
arbitrary external browsing → system browser
OAuth/OIDC → provider-approved system auth/browser flow
background media → dedicated media APIs
large download → application/native download stack
Do not embed a browser merely because rendering HTML is convenient.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 480 lines · 115 tokens per session scan A 0e90598c3e0a
flutter-webview-production-engineering is a skill published in the GitHub repository ariaramin/flutter-skills (6 stars, last pushed 7d ago), licensed MIT. It adds 115 tokens to every session and 4,822 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.
Other skills, from other repositories
windows-ops
Comprehensive Windows workstation operations - diagnose slow boot, failing drives, BSOD crashes, startup bloat, runaway processes, event logs. Use for: Windows is slow, slow bootup, won't boot, blue screen, BSOD, kernel crash, drive failing, SMART errors, disk errors, Event 41, Event 129, storahci reset, BugCheck…
speq-audit
Audit a speq project's health — spec-library structure, feature/decision-log/plan validation, ADR noise, mission-to-spec sync, unrecorded plans, and gitignore hygiene — then guide fixes. Use when the user asks to audit, health-check, doctor, lint, or sanity-check the specs or repo, or after cloning or inheriting a…
bridge-troubleshooting
Diagnose figma-mcp-rust connection problems. Use when tools fail with "plugin not connected", requests time out, the port is already in use, or the Figma plugin cannot reach the MCP server. Covers installing the companion Figma plugin, port 1994, and running multiple MCP clients.
landing-page-conversion
Build or improve landing pages and marketing sites that convert, not just look good. Use when writing a hero, structuring a page, choosing a CTA, adding social proof, or diagnosing why a page isn't converting. Covers positioning, copy-first workflow, the above-the-fold contract, page narrative, CTAs, trust, and…
diagnose-hid-keycodes
Find out what an unknown USB/Bluetooth HID button actually emits without assuming the label or documentation. Uses Karabiner's.
frontend-design
Production-grade UI/UX guidance — not generic AI slop. Triggers on design, UI, frontend, component, styling, layout, make it look good.