Before a release I used to run the same mental checklist. Is the privacy manifest there? Is anything in pubspec.yaml abandoned? Did someone hardcode a string again? Is a token sitting in the source?

A checklist in your head gets skipped when the deadline is close. So I turned mine into four Claude Code skills. Each one reads the project, works through a fixed list of checks, and writes a Markdown report with a fix for every finding.

The four skills

Security: /owasp-mobile-audit covers all ten OWASP Mobile Top 10 (2024) categories plus six newer checks, like hardcoded secrets, data leaking into logs, and unsafe sharing. It works on Flutter, native Android, and native iOS code.

Dependencies: /flutter-dependency-audit looks at seven things in your packages: outdated and abandoned ones, duplicates that do the same job, license conflicts, known CVEs, loose version constraints, and leftover dependency overrides.

Localization: /flutter-localization-audit runs eight checks: hardcoded strings, missing ARB keys, the l10n setup, plural and gender forms, RTL layouts, locale-aware dates and numbers, broken interpolation, and the fallback locale.

Store readiness: /flutter-store-readiness runs eight checks for App Store and Google Play: the iOS Privacy Manifest, Android Data Safety, permission strings, screenshots, age rating, metadata limits, and the platform configs such as signing and targetSdk.

Try it

Install the ones you want:

npx skills add NoaTubic/owasp-mobile-audit-skill
npx skills add NoaTubic/flutter-dependency-audit-skill
npx skills add NoaTubic/flutter-localization-audit-skill
npx skills add NoaTubic/flutter-store-readiness-skill

Then, inside Claude Code, in your Flutter project:

/flutter-store-readiness

Each skill saves its report in the project root, for example store_readiness_report.md. You can also run only the checks you care about:

/owasp-mobile-audit M9,AE2
/flutter-dependency-audit security,licenses
/flutter-localization-audit hardcoded,arb
/flutter-store-readiness ios

What a report looks like

Every report uses the same shape. It opens with a summary: a count per severity, from Critical to Info. The store readiness report also gives each platform a status of ready, issues found, or blocking.

Then each category gets its findings. A finding has the file and line, the evidence, and one sentence on how to fix it. The report also lists what's already done right, so you don't "fix" something that works. It ends with the three to five fixes that matter most.

The severity scale is about consequences, not style. In the store readiness skill, Critical means an automatic rejection, like a missing Privacy Manifest or debug signing on a release build. In the security skill, Critical means something directly exploitable, like a hardcoded credential or disabled TLS.

A few things they catch that people miss

• A Privacy Manifest that exists but leaves out a Required Reason API your code or an SDK uses
• Permission strings like "This app needs the camera", which Apple tends to reject as too vague
• A package that hasn't had a release in years, with an active alternative
• Dates shown with DateTime.toString() instead of a locale-aware formatter
• An API key in source, or a token written to the logs

What they are and aren't

These are skills, so Claude does the reading. That means they understand context a regex can't, like whether a string is user-facing or a log tag. It also means a finding is a well-argued suggestion, not a proof. Check each one before you act on it, and keep your real scanners and your store review in the loop. The skills are there to catch the obvious misses early.

Try it yourself

Run /flutter-store-readiness on your app before the next release and fix the Critical items first. The skills, their checks, and the full report templates are here:

npx skills add NoaTubic/owasp-mobile-audit-skill

npx skills add NoaTubic/flutter-dependency-audit-skill

/flutter-dependency-audit

/flutter-dependency-audit security
/flutter-dependency-audit outdated,licenses
/flutter-dependency-audit security,pinning,overrides

npx skills add NoaTubic/flutter-localization-audit-skill

/flutter-localization-audit

/flutter-localization-audit hardcoded
/flutter-localization-audit arb,rtl
/flutter-localization-audit hardcoded,arb,plurals,rtl

npx skills add NoaTubic/flutter-store-readiness-skill

/flutter-store-readiness

Feedback and issues are welcome on GitHub.