Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fluttersdk/ai/magic-frameworknpx skills add fluttersdk/ai --skill magic-frameworkgit clone --depth 1 https://github.com/fluttersdk/aiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00181 | $0.08156 |
| Opus 5 | $0.00090 | $0.04078 |
| Sonnet 5 | $0.00036 | $0.01631 |
| Haiku 4.5 | $0.00018 | $0.00816 |
Grade B, and why
magic-framework scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
The magic CLI ships as an `artisan` executable in magic's `pubspec.yaml` (`executables: { artisan: }`, backed by `bin/artisan.dart`). Once magic is a dependency, run any command with `dart run magic:artisan <cmd>`. There How it starts
The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Magic Framework
Laravel-inspired Flutter framework: IoC container, 18 facades, Eloquent-style ORM, service providers, reactive controllers, and GoRouter-backed routing. This skill makes an agent write code that an experienced magic developer would write: facade-first, IoC-resolved, reactive, and verified against the real API in lib/src. All visual styling is handled by Wind (load the wind-ui skill for className work); this skill owns architecture, data, navigation, auth, and testing.
The host app already depends on package:magic/magic.dart. The accuracy contract for this skill: every API you write must exist in lib/src. When unsure of a signature, open the source or the matching doc/** page rather than guessing; magic is pre-1.0 and the surface is exact, not approximate.
0. Before writing code in this project
Three checks, each pays off across the whole session.
- Read
lib/main.dartandlib/config/app.dart. Note theproviderslist and its ORDER (AppServiceProvider must precede AuthServiceProvider sosetUserFactoryis set before auth restore runs), and whetherconfigFactoriesorconfigsis used. - Scan one existing controller + view pair in
lib/app/for the project's idioms: the singleton accessor shape, how views resolve controllers, how forms are wired. Match the surrounding code, do not invent a dialect. - CLI invocation. Magic ships an
artisanexecutable, so every command runs asdart run magic:artisan <cmd>from any app that depends on magic (no package-name placeholder, no global activate).
1. Core Laws
Hard constraints for every line of magic code.
await Magic.init()first. It must be awaited inmain()before any facade call and beforerunApp(). Never.then(); providers are not booted until the future completes.- Facade-first. Reach for
Auth,Http,Config,Cache,DB,Schema,Log,Event,Echo,Lang,MagicRoute,Gate,Session,Vault,Storage,Pick,Crypt,Launch. Resolve from the container manually (Magic.make<T>('key')) only when extending the framework. - Controllers are singletons.
static X get instance => Magic.findOrPut(X.new);is the canonical accessor. Views resolve controllers viaMagic.find<T>()(automatic inMagicView), never through constructors. - IoC over
newfor services. Bind in a provider'sregister(), resolve via the facade orMagic.make<T>('key'). Do not scatterService()construction across the app. - Provider discipline.
register()is synchronous and is where routes and bindings go.boot()is async and may resolve other services; setAuth.manager.setUserFactory(...)here. - Reactive state, not setState. Controllers extend
MagicController(aChangeNotifier); state flows throughMagicStateMixin+RxStatus. UserefreshUI()(guardednotifyListeners, and the single seam every controller notification goes through, including validation),setLoading/setSuccess/setError/setEmpty, andMagicBuilderfor sections.MagicController.onRefreshUIis a null-by-default static debug tooling sets to observe those notifications. LocalsetStatebelongs only to genuine widget-local UI state inside aMagicStatefulView. - Typed attribute access. Models use
get<T>('key')andset('key', v), never rawgetAttribute. Declarefillable; usefill(validated, strict: true)after validation so schema drift throwsMassAssignmentException. - Context-free navigation and feedback.
MagicRoute.to/back/replace,Magic.snackbar/toast/dialog/confirm/loading. Never depend on aBuildContextfor navigation or feedback. Never navigate or fetch insidebuild(). - Validate at the boundary.
MagicFormDatafor forms,FormRequestfor complex payloads,Validatorfor ad hoc checks. Surface server errors withhandleApiError(response)(from theValidatesRequestsmixin). - Trailing commas, multi-line collections. Always. Match the project's existing style.
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/auth-system.md 15 KB
- references/bootstrap-lifecycle.md 12 KB
- references/cli-commands.md 24 KB
- references/community.md 7.1 KB
- references/controllers-views.md 17 KB
- references/eloquent-orm.md 19 KB
- references/facades-api.md 33 KB
- references/forms-validation.md 22 KB
- references/http-network.md 23 KB
- references/plugin-deeplink.md 11 KB
- references/plugin-devtools.md 11 KB
- references/plugin-notifications.md 19 KB
- references/plugin-payments.md 8.8 KB
- references/plugin-social-auth.md 15 KB
- references/plugin-starter.md 34 KB
- references/routing-navigation.md 18 KB
- references/secondary-systems.md 41 KB
- references/templates.md 9.4 KB
- references/testing-patterns.md 32 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 395 lines · 181 tokens per session scan B b56a516368af
magic-framework is a skill published in the GitHub repository fluttersdk/ai (2 stars, last pushed yesterday), licensed MIT. It adds 181 tokens to every session and 8,156 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
flutter-duit-bdui
Integrate, fix, review, migrate, test, or debug Duit / flutterduit backend-driven UI in Flutter applications. Use when a task mentions DUIT, flutterduit, backend-driven UI, BDUI, server-driven UI, XDriver, DuitViewHost, DuitRegistry, HTTP or WebSocket transports, custom Duit widgets, components, capability delegates…
flutter-internationalization
Add, fix, audit, and maintain Flutter internationalization with gen-l10n, ARB files, AppLocalizations, flutterlocalizations, intl formatting, plural/select messages, RTL support, locale-specific number/date formatting, and localization build errors. Use when asked to add l10n or i18n, translate Flutter UI text…
agents-md-generator
Create, generate, update, repair, trim, or split minimal AGENTS.md files for repository roots and confirmed nested modules using progressive disclosure. Use for missing, bloated, contradictory, or outdated agent instructions, monorepos, services, packages, module context, and portable agent guidance without assuming…
flutter-navigation
Implement, fix, refactor, review, migrate, or validate Flutter navigation and routing. Use when working with Navigator, MaterialPageRoute, Router API, gorouter, route guards, redirects, ShellRoute or StatefulShellRoute, nested Navigators, passing and returning route data, deep links, Android App Links, iOS Universal…
flutter-animations
Add, fix, refactor, debug, test, or explain Flutter animations and motion effects. Use when working with implicit animations such as AnimatedContainer, AnimatedOpacity, AnimatedSwitcher, and TweenAnimationBuilder; explicit animations using AnimationController, Tween, CurvedAnimation, AnimatedWidget, AnimatedBuilder…
flutter-drift
Implement, fix, review, migrate, test, or debug Drift persistence in Flutter apps using SQLite, driftflutter, type-safe Dart queries, generated tables, StreamBuilder or Riverpod StreamProvider UI, write operations, transactions, schema migrations, web assets, isolate sharing, and local database testing. Use when a…