magic-framework

Coding guidance for Flutter apps that use the Magic framework, a Laravel-inspired toolkit for Dart applications. It covers the app’s structure, data, navigation, authentication, and tests.

In plain words
What is it for?
Use it when adding or changing Magic-based Flutter controllers, data access, routes, authentication, services, or tests.
Why use it?
It helps an agent follow the project’s real framework APIs and existing conventions instead of guessing how the app is built.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/fluttersdk/ai/magic-framework
Any agent
npx skills add fluttersdk/ai --skill magic-framework
Clone the repo
git clone --depth 1 https://github.com/fluttersdk/ai

Made for: Claude Code, Codex.

Per session 181 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 8,156 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00181 $0.08156
Opus 5 $0.00090 $0.04078
Sonnet 5 $0.00036 $0.01631
Haiku 4.5 $0.00018 $0.00816

Measured yesterday against content hash b56a516368af, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

magic-framework scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

The magic CLI ships as an `artisan` executable in magic's `pubspec.yaml` (`executables: { artisan: }`, backed by `bin/artisan.dart`). Once magic is a dependency, run any command with `dart run magic:artisan <cmd>`. There
skills/magic-framework/SKILL.md · 395 lines

How it starts

The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Magic Framework

Laravel-inspired Flutter framework: IoC container, 18 facades, Eloquent-style ORM, service providers, reactive controllers, and GoRouter-backed routing. This skill makes an agent write code that an experienced magic developer would write: facade-first, IoC-resolved, reactive, and verified against the real API in lib/src. All visual styling is handled by Wind (load the wind-ui skill for className work); this skill owns architecture, data, navigation, auth, and testing.

The host app already depends on package:magic/magic.dart. The accuracy contract for this skill: every API you write must exist in lib/src. When unsure of a signature, open the source or the matching doc/** page rather than guessing; magic is pre-1.0 and the surface is exact, not approximate.

0. Before writing code in this project

Three checks, each pays off across the whole session.

  1. Read lib/main.dart and lib/config/app.dart. Note the providers list and its ORDER (AppServiceProvider must precede AuthServiceProvider so setUserFactory is set before auth restore runs), and whether configFactories or configs is used.
  2. Scan one existing controller + view pair in lib/app/ for the project's idioms: the singleton accessor shape, how views resolve controllers, how forms are wired. Match the surrounding code, do not invent a dialect.
  3. CLI invocation. Magic ships an artisan executable, so every command runs as dart run magic:artisan <cmd> from any app that depends on magic (no package-name placeholder, no global activate).

1. Core Laws

Hard constraints for every line of magic code.

  1. await Magic.init() first. It must be awaited in main() before any facade call and before runApp(). Never .then(); providers are not booted until the future completes.
  2. Facade-first. Reach for Auth, Http, Config, Cache, DB, Schema, Log, Event, Echo, Lang, MagicRoute, Gate, Session, Vault, Storage, Pick, Crypt, Launch. Resolve from the container manually (Magic.make<T>('key')) only when extending the framework.
  3. Controllers are singletons. static X get instance => Magic.findOrPut(X.new); is the canonical accessor. Views resolve controllers via Magic.find<T>() (automatic in MagicView), never through constructors.
  4. IoC over new for services. Bind in a provider's register(), resolve via the facade or Magic.make<T>('key'). Do not scatter Service() construction across the app.
  5. Provider discipline. register() is synchronous and is where routes and bindings go. boot() is async and may resolve other services; set Auth.manager.setUserFactory(...) here.
  6. Reactive state, not setState. Controllers extend MagicController (a ChangeNotifier); state flows through MagicStateMixin + RxStatus. Use refreshUI() (guarded notifyListeners, and the single seam every controller notification goes through, including validation), setLoading/setSuccess/setError/setEmpty, and MagicBuilder for sections. MagicController.onRefreshUI is a null-by-default static debug tooling sets to observe those notifications. Local setState belongs only to genuine widget-local UI state inside a MagicStatefulView.
  7. Typed attribute access. Models use get<T>('key') and set('key', v), never raw getAttribute. Declare fillable; use fill(validated, strict: true) after validation so schema drift throws MassAssignmentException.
  8. Context-free navigation and feedback. MagicRoute.to/back/replace, Magic.snackbar/toast/dialog/confirm/loading. Never depend on a BuildContext for navigation or feedback. Never navigate or fetch inside build().
  9. Validate at the boundary. MagicFormData for forms, FormRequest for complex payloads, Validator for ad hoc checks. Surface server errors with handleApiError(response) (from the ValidatesRequests mixin).
  10. Trailing commas, multi-line collections. Always. Match the project's existing style.

Read the full file on GitHub · 395 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 395 lines · 181 tokens per session scan B b56a516368af

Subscribe to this mod's changes

magic-framework is a skill published in the GitHub repository fluttersdk/ai (2 stars, last pushed yesterday), licensed MIT. It adds 181 tokens to every session and 8,156 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

flutter-duit-bdui

Integrate, fix, review, migrate, test, or debug Duit / flutterduit backend-driven UI in Flutter applications. Use when a task mentions DUIT, flutterduit, backend-driven UI, BDUI, server-driven UI, XDriver, DuitViewHost, DuitRegistry, HTTP or WebSocket transports, custom Duit widgets, components, capability delegates…

MADTeacher/mad-agents-skills · 94 tokens

flutter-internationalization

Add, fix, audit, and maintain Flutter internationalization with gen-l10n, ARB files, AppLocalizations, flutterlocalizations, intl formatting, plural/select messages, RTL support, locale-specific number/date formatting, and localization build errors. Use when asked to add l10n or i18n, translate Flutter UI text…

MADTeacher/mad-agents-skills · 98 tokens

agents-md-generator

Create, generate, update, repair, trim, or split minimal AGENTS.md files for repository roots and confirmed nested modules using progressive disclosure. Use for missing, bloated, contradictory, or outdated agent instructions, monorepos, services, packages, module context, and portable agent guidance without assuming…

MADTeacher/mad-agents-skills · 69 tokens

flutter-navigation

Implement, fix, refactor, review, migrate, or validate Flutter navigation and routing. Use when working with Navigator, MaterialPageRoute, Router API, gorouter, route guards, redirects, ShellRoute or StatefulShellRoute, nested Navigators, passing and returning route data, deep links, Android App Links, iOS Universal…

MADTeacher/mad-agents-skills · 95 tokens

flutter-animations

Add, fix, refactor, debug, test, or explain Flutter animations and motion effects. Use when working with implicit animations such as AnimatedContainer, AnimatedOpacity, AnimatedSwitcher, and TweenAnimationBuilder; explicit animations using AnimationController, Tween, CurvedAnimation, AnimatedWidget, AnimatedBuilder…

MADTeacher/mad-agents-skills · 109 tokens

flutter-drift

Implement, fix, review, migrate, test, or debug Drift persistence in Flutter apps using SQLite, driftflutter, type-safe Dart queries, generated tables, StreamBuilder or Riverpod StreamProvider UI, write operations, transactions, schema migrations, web assets, isolate sharing, and local database testing. Use when a…

MADTeacher/mad-agents-skills · 111 tokens