flutter-setup-localization
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a localization workflow where the agent ingests text from external .arb files to generate code, creating a potential surface for indirect instruction injection if translation files are sourced from untrusted third parties.
- Ingestion points: The agent is instructed to read and process localization files located at
lib/l10n/*.arb(SKILL.md). - Boundary markers: No specific delimiters or safety instructions are defined for the content of the ARB files, which follow the standard JSON format.
- Capability inventory: The skill uses
flutter gen-l10nto compile the ingested strings into synthetic Dart code packages. - Sanitization: Relies on the standard parser and generator provided by the Flutter framework for ICU message syntax.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download standard, well-known libraries from the official Flutter package registry.
- Evidence: Commands include
flutter pub add flutter_localizationsandflutter pub add intl:any(SKILL.md). - [COMMAND_EXECUTION]: The skill provides standard shell commands for package management and environment configuration.
- Evidence: The workflow includes
flutter pub add,flutter pub get, andflutter gen-l10n(SKILL.md).
Audit Metadata