四個 Claude Code 技能協助審核 Flutter 應用程式

Before a release I used to run the same mental checklist. Is the privacy manifest there? Is anything in pubspec.yaml abandoned? Did someone hardcode a string again? Is a token sitting in the source?

A checklist in your head gets skipped when the deadline is close. So I turned mine into four Claude Code skills. Each one reads the project, works through a fixed list of checks, and writes a Markdown report with a fix for every finding.

The four skills

Security: /owasp-mobile-audit covers all ten OWASP Mobile Top 10 (2024) categories plus six newer checks, like hardcoded secrets, data leaking into logs, and unsafe sharing. It works on Flutter, native Android, and native iOS code.

Dependencies: /flutter-dependency-audit looks at seven things in your packages: outdated and abandoned ones, duplicates that do the same job, license conflicts, known CVEs, loose version constraints, and leftover dependency overrides.

Localization: /flutter-localization-audit runs eight checks: hardcoded strings, missing ARB keys, the l10n setup, plural and gender forms, RTL layouts, locale-aware dates and numbers, broken interpolation, and the fallback locale.

Store readiness: /flutter-store-readiness runs eight checks for App Store and Google Play: the iOS Privacy Manifest, Android Data Safety, permission strings, screenshots, age rating, metadata limits, and the platform configs such as signing and targetSdk.

Try it

Install the ones you want:

npx skills add NoaTubic/owasp-mobile-audit-skill
npx skills add NoaTubic/flutter-dependency-audit-skill
npx skills add NoaTubic/flutter-localization-audit-skill
npx skills add NoaTubic/flutter-store-readiness-skill

Then, inside Claude Code, in your Flutter project:

/flutter-store-readiness

Each skill saves its report in the project root, for example store_readiness_report.md. You can also run only the checks you care about:

/owasp-mobile-audit M9,AE2
/flutter-dependency-audit security,licenses
/flutter-localization-audit hardcoded,arb
/flutter-store-readiness ios

What a report looks like

Every report uses the same shape. It opens with a summary: a count per severity, from Critical to Info. The store readiness report also gives each platform a status of ready, issues found, or blocking.

Then each category gets its findings. A finding has the file and line, the evidence, and one sentence on how to fix it. The report also lists what's already done right, so you don't "fix" something that works. It ends with the three to five fixes that matter most.

The severity scale is about consequences, not style. In the store readiness skill, Critical means an automatic rejection, like a missing Privacy Manifest or debug signing on a release build. In the security skill, Critical means something directly exploitable, like a hardcoded credential or disabled TLS.

A few things they catch that people miss

• A Privacy Manifest that exists but leaves out a Required Reason API your code or an SDK uses
• Permission strings like "This app needs the camera", which Apple tends to reject as too vague
• A package that hasn't had a release in years, with an active alternative
• Dates shown with DateTime.toString() instead of a locale-aware formatter
• An API key in source, or a token written to the logs

What they are and aren't

These are skills, so Claude does the reading. That means they understand context a regex can't, like whether a string is user-facing or a log tag. It also means a finding is a well-argued suggestion, not a proof. Check each one before you act on it, and keep your real scanners and your store review in the loop. The skills are there to catch the obvious misses early.

Try it yourself

Run /flutter-store-readiness on your app before the next release and fix the Critical items first. The skills, their checks, and the full report templates are here:

NoaTubic / owasp-mobile-audit-skill

OWASP Mobile Top 10 (2024) security audit skill for Claude Code — covers all 10 categories + 6 emerging checks, with per-rule filtering

OWASP Mobile Audit Skill

A Claude Code skill that performs a comprehensive OWASP Mobile Top 10 (2024) security audit on mobile codebases and produces a structured, actionable markdown report.

Covers all 10 official OWASP Mobile categories plus 6 additional emerging checks, with each finding mapped to a severity level and concrete remediation advice.

What it audits

Installation

npx skills add NoaTubic/owasp-mobile-audit-skill

Or add it manually by copying SKILL.md and references/ into your Claude Code skills directory.

Usage

Full audit (all

…

Flutter Dependency Audit Skill

A Claude Code skill that performs a comprehensive dependency audit on a Flutter/Dart project and produces a structured, actionable markdown report.

Covers 7 audit categories — from outdated and abandoned packages to license conflicts, known CVEs, and version pinning issues.

What it audits

Installation

npx skills add NoaTubic/flutter-dependency-audit-skill

Or add it manually by copying SKILL.md and references/ into your Claude Code skills directory.

Usage

Full audit (all 7 checks)

/flutter-dependency-audit

Audit specific categories only

Pass a comma-separated list of category IDs:

/flutter-dependency-audit security
/flutter-dependency-audit outdated,licenses
/flutter-dependency-audit security,pinning,overrides

Only the listed categories will be run. The report header notes which categories were in scope.

Output

The skill saves a dependency_audit_report.md file in your project root containing:

• Executive Summary…

NoaTubic / flutter-localization-audit-skill

Flutter/Dart localization audit skill for Claude Code — finds hardcoded strings, missing ARB keys, RTL issues, broken plural forms, and locale-unaware formatting

Flutter Localization Audit Skill

A Claude Code skill that performs a comprehensive localization audit on a Flutter/Dart project and produces a structured, actionable markdown report.

Covers 8 audit categories — from hardcoded strings and missing ARB translations to RTL support, plural forms, and locale-unaware date formatting.

What it audits

Installation

npx skills add NoaTubic/flutter-localization-audit-skill

Or add it manually by copying SKILL.md and references/ into your Claude Code skills directory.

Usage

Full audit (all 8 checks)

/flutter-localization-audit

Audit specific categories only

Pass a comma-separated list of category IDs:

/flutter-localization-audit hardcoded
/flutter-localization-audit arb,rtl
/flutter-localization-audit hardcoded,arb,plurals,rtl

Only the listed categories will be run. The report header notes which categories were in scope.

Output

The skill saves a localization_audit_report.md…

NoaTubic / flutter-store-readiness-skill

App Store & Google Play submission readiness audit skill for Claude Code — checks iOS Privacy Manifest, Android Data Safety, permissions, screenshots, age rating, and metadata limits

Flutter Store Readiness Skill

A Claude Code skill that performs a comprehensive App Store and Google Play submission readiness audit on a Flutter project and produces a structured checklist report.

Covers 8 audit categories — iOS Privacy Manifest, Android Data Safety, permissions, screenshots, age rating, metadata limits, and platform-specific configs — so you catch every rejection reason before Apple or Google does.

What it audits

Installation

npx skills add NoaTubic/flutter-store-readiness-skill

Or add it manually by copying SKILL.md and references/ into your Claude Code skills directory.

Usage

Full audit (all 8 checks, both platforms)

/flutter-store-readiness

Audit specific categories only

…

Feedback and issues are welcome on GitHub.