The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill identifies and references official Scandit SDK dependencies hosted on Maven Central. It correctly instructs the agent to fetch the latest version information from Sonatype's official repository search service, which is a well-known and expected practice for software development tools.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it is designed to analyze and modify user-provided Android project files, including source code and build configurations.
Ingestion points: User-provided Kotlin/Java source files and Gradle build scripts.
Boundary markers: None explicitly defined in the provided instructions for user code ingestion.
Capability inventory: The skill instructions focus on code generation and file modification rather than direct system-level execution or unauthorized network communication.
Sanitization: No specific sanitization or filtering of the user-provided code is mentioned.
This surface is standard for coding assistant skills and represents the intended functionality rather than a malicious vector.
[PROMPT_INJECTION]: Heuristic detections flagged instructions regarding user interaction (e.g., avoiding telling the user to check documentation themselves) as potential concealment. However, manual review confirms these are benign stylistic instructions intended to improve the agent's helpfulness and do not represent attempts to bypass safety filters or hide malicious activity.

barcode-capture-android