Skip to content
skillsafebeta
← Report library
Purpose / Other

Flutter Setup Localization Skill Security Audit

What the author says it does (original text)

Add `flutter_localizations` and `intl` dependencies, enable "generate true" in `pubspec.yaml`, and create an `l10n.yaml` configuration file. Use when initializing localization support for a new Flutter project.

Independent security check

Low-risk issues found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Low risk

`intl:any` permits any available version during initial resolution

Source references: 4
What we found

The Skill explicitly adds `intl:any` without a version boundary. If no lockfile exists, or the lockfile is refreshed, the resolved version depends on what the package source offers at that time rather than a compatibility range reviewed by the Skill.

Why this matters

The project may receive a newer version not validated by this Skill, changing build or runtime behavior and making the dependency set harder to reproduce from configuration alone. The evidence does not show a malicious package, credential access, or an actual attack.

This is an active setup command, not a warning example: it adds `intl` with the unbounded `any` constraint. During first resolution, when no lockfile exists, or when the lockfile is refreshed, Pub may select any version then compatible with the remaining constraints. This reduces reproducibility and can introduce behavior from a release the Skill did not review. The dependency is relevant to the stated localization purpose, so this is not evidence of unauthorized scope. Users can ask for a tested version range and retain and review `pubspec.lock` and resolved dependency changes.

SKILL.md:34In the instructionsOpen original file
flutter pub add flutter_localizations --sdk=flutterflutter pub add intl:any```
Show 3 other places
SKILL.md:42In the instructionsOpen original file
    sdk: flutter  flutter_localizations:    sdk: flutter  intl: any```
SKILL.md:3In the instructionsOpen original file
name: flutter-setup-localizationdescription: Add `flutter_localizations` and `intl` dependencies, enable "generate true" in `pubspec.yaml`, and create an `l10n.yaml` configuration file. Use when initializing localization support for a new Flutter project.metadata:
SKILL.md:31In the instructionsOpen original file
### 1. Add DependenciesAdd the required localization packages to the project. Execute the following commands in the terminal:```bashflutter pub add flutter_localizations --sdk=flutterflutter pub add intl:any```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill modifies a Flutter project's dependencies and localization configuration and instructs the user to run Flutter package-manager commands; this changes pubspec configuration and resolves dependencies.

View source
SKILL.md:31In the instructionsOpen original file
### 1. Add DependenciesAdd the required localization packages to the project. Execute the following commands in the terminal:```bashflutter pub add flutter_localizations --sdk=flutterflutter pub add intl:any```
SKILL.md:47In the instructionsOpen original file
### 2. Enable Code GenerationOpen `pubspec.yaml` and enable the `generate` flag within the `flutter` section to automate localization tasks:```yamlflutter:  generate: true```
SKILL.md:54In the instructionsOpen original file
### 3. Create Configuration FileCreate a new file named `l10n.yaml` in the root directory of the Flutter project. Define the input directory, template file, and output file:```yamlarb-dir: lib/l10ntemplate-arb-file: app_en.arboutput-localization-file: app_localizations.dartsynthetic-package: true```

It also directs changes to the app entry point and supported-language ARB files, then uses `flutter pub get` to generate localization code; these actions align with its stated Flutter-localization purpose.

View source
SKILL.md:63In the instructionsOpen original file
### 4. Configure the App Entry PointImport the generated localizations and the `flutter_localizations` library in your `main.dart`. Inject the delegates and supported locales into your `MaterialApp` or `CupertinoApp`.
SKILL.md:90In the instructionsOpen original file
### 1. Define ARB Files*   **If creating NEW content:** Add the base string to the template file (`lib/l10n/app_en.arb`). Include a description for context.*   **If EDITING existing content:** Locate the key in all supported `.arb` files and update the values.
SKILL.md:110In the instructionsOpen original file
### 2. Generate Localization ClassesRun the following command to trigger code generation:```bashflutter pub get```*Feedback Loop:* Run validator -> review terminal output for ARB syntax errors -> fix missing commas or mismatched placeholders -> re-run `flutter pub get`.
Start here · InstructionsSKILL.md
flutter-setup-localization
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:32In the instructionsOpen original file
Add the required localization packages to the project. Execute the following commands in the terminal:```bashflutter pub add flutter_localizations --sdk=flutter
SKILL.md:112In the instructionsOpen original file
Run the following command to trigger code generation:```bashflutter pub get
Lines read
211
File checksum (to compare versions)
e52babe87afa1694f1e34f08c8b938d0b4aef54454f093e7df84b4c21596b485