flutter-localization

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the synchronization of local assets with remote content by utilizing the sheet_loader_localization package to fetch data from Google Sheets. This is a standard development workflow for localization automation using well-known cloud services.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection, as it is designed to ingest and render data from external translation files (CSV, JSON, and Google Sheets) into the application UI. While this is the intended functionality of a localization skill, it assumes the source data is trustworthy.
  • Ingestion points: Translation data is ingested from assets/translations/*.json, assets/langs/*.csv, and remote Google Sheets IDs specified in pubspec.yaml.
  • Boundary markers: No specific delimiters or safety instructions were identified for the strings being rendered via the .tr() extension.
  • Capability inventory: The skill utilizes the flutter pub run CLI command for asset synchronization and standard Flutter widget rendering for text display.
  • Sanitization: No explicit sanitization or validation of the translation string content is described before rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 06:21 AM