flutter-localization
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the synchronization of local assets with remote content by utilizing the
sheet_loader_localizationpackage to fetch data from Google Sheets. This is a standard development workflow for localization automation using well-known cloud services. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection, as it is designed to ingest and render data from external translation files (CSV, JSON, and Google Sheets) into the application UI. While this is the intended functionality of a localization skill, it assumes the source data is trustworthy.
- Ingestion points: Translation data is ingested from
assets/translations/*.json,assets/langs/*.csv, and remote Google Sheets IDs specified inpubspec.yaml. - Boundary markers: No specific delimiters or safety instructions were identified for the strings being rendered via the
.tr()extension. - Capability inventory: The skill utilizes the
flutter pub runCLI command for asset synchronization and standard Flutter widget rendering for text display. - Sanitization: No explicit sanitization or validation of the translation string content is described before rendering.
Audit Metadata