matrixscan-count-android

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow ingests decoded barcode payloads (e.g., trackedBarcode.barcode.data / session.recognizedBarcodes) into the app’s callback context, and those payloads are outsider-authored free text produced by external barcodes in the environment (not authored by the operating user).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch remote documentation and artifact pages at runtime (e.g. https://central.sonatype.com/artifact/com.scandit.datacapture/barcode and various https://docs.scandit.com/... pages) to extract API links and the latest dependency version which are then injected into generated code/instructions, meaning external content directly controls the agent's outputs.