id-capture-android
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill uses safe placeholders like
-- ENTER YOUR SCANDIT LICENSE KEY HERE --for license keys in its code snippets and instructions, avoiding the leakage of actual credentials. - [EXTERNAL_DOWNLOADS]: The skill references official developer documentation from
docs.scandit.comand public package information fromcentral.sonatype.com. These are legitimate resources for the intended purpose of assisting with SDK integration. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data from identity documents. While this introduces a potential attack surface if an attacker provides a document with malicious text, the skill correctly handles the data as structured objects within the application's runtime environment.
- [COMMAND_EXECUTION]: The code samples provided are standard Android (Kotlin/Java) components for UI and SDK management. No arbitrary shell execution or unsafe system calls were identified.
Audit Metadata