Flutter Medic

Flutter Medic

A GitLab Duo agent that keeps Flutter/Dart projects healthy and secure, and, crucially, proves its fixes are safe before you merge them.

Inspiration

Every Flutter team carries the same quiet debt: outdated packages, deprecated APIs, and the occasional security advisory buried in a transitive dependency. The scary part isn't finding them, it's fixing them without knowing what else you'll break. We wanted an agent that doesn't just flag a vulnerable package, but answers the real question a developer has: "where is this actually used, and will changing it break my build?"

What it does

Flutter Medic runs the full remediation loop on a Flutter project:

1. Inventories dependencies from pubspec.yaml / pubspec.lock.
2. Cross references security findings through GitLab Orbit.
3. Traces blast radius - it queries Orbit's codebase graph to find every file that touches an affected package before it changes anything.
4. Applies the minimal safe fix - a patch/minor bump, a major bump with the changed call sites updated, and the deprecated APIs it touches (e.g. Color.withOpacity → withValues).
5. Opens a merge request on a new branch with a structured, auditable body: Summary, Findings, Blast Radius (citing the exact files), Risk, Verification.
6. Proves it's safe - the MR pipeline rebuilds every release flavor (dev / staging / prod). Green across all three is the evidence the fix holds.

How we built it

It's an AI Catalog agent whose system prompt encodes the remediation workflow, backed by two project-level skills (flutter-medic and flutter-release-setup) stored as SKILL.md files in the repo. The agent is wired to a minimum-privilege tool set, repository reads, Gitlab Blob Search, Orbit: Query Graph, the security-finding tools, Create Commit, Create Merge Request, and the pipeline/job-log tools, so it can read, trace, fix, ship, and verify without overreach. Orbit context is queried automatically and zero rated, so the blast-radius trace comes for free.

Challenges we ran into

• Making the trace real, not cosmetic. A fresh app gives Orbit nothing to find, so we built a demo app with deliberately planted issues, an outdated intl, a major version share_plus bump with a genuine API change, and a deprecated widget, so the graph traversal had something honest to show.
• Knowing where skills load. Project skills load in local Duo and flows but not in browser Duo Chat, so we put the core workflow in the agent's system prompt and let the skills add depth, the agent works everywhere.

What we learned

Treating Orbit as the grounding step, proving where a change lands before making it, turns "auto fix" from something risky into something you'd actually let near your default branch. The merge request, not the edit, is the product.

What's next

Trigger driven flows (run on a new security finding), broader pub advisory coverage, and one command release configuration via the flutter-release-setup skill.

Built With

• ai-catalog
• dart
• flutter
• gitlab-ci
• gitlab-duo-agent-platform
• gitlab-orbit