flutter-setup-localization

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a localization workflow where the agent ingests text from external .arb files to generate code, creating a potential surface for indirect instruction injection if translation files are sourced from untrusted third parties.
  • Ingestion points: The agent is instructed to read and process localization files located at lib/l10n/*.arb (SKILL.md).
  • Boundary markers: No specific delimiters or safety instructions are defined for the content of the ARB files, which follow the standard JSON format.
  • Capability inventory: The skill uses flutter gen-l10n to compile the ingested strings into synthetic Dart code packages.
  • Sanitization: Relies on the standard parser and generator provided by the Flutter framework for ICU message syntax.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download standard, well-known libraries from the official Flutter package registry.
  • Evidence: Commands include flutter pub add flutter_localizations and flutter pub add intl:any (SKILL.md).
  • [COMMAND_EXECUTION]: The skill provides standard shell commands for package management and environment configuration.
  • Evidence: The workflow includes flutter pub add, flutter pub get, and flutter gen-l10n (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 07:04 AM
Security Audit — agent-trust-hub — flutter-setup-localization