barcode-capture-ios
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that direct the agent to suppress certain information from the user, such as not telling the user to check documentation themselves and only showing summaries of applied changes. While intended for user experience, this can limit transparency regarding the agent's actions.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Scandit Data Capture SDK via Swift Package Manager from the vendor's GitHub repository (https://github.com/Scandit/datacapture-spm). This is a legitimate dependency for the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from user-provided project files which could potentially contain malicious instructions.
- Ingestion points: Project files like Package.resolved, Podfile.lock, and Swift source files are read to detect versions and existing code.
- Boundary markers: No explicit markers are used to separate user-provided code from the agent's processing instructions.
- Capability inventory: The agent is authorized to write code directly into the user's project files to perform integration and migration tasks.
- Sanitization: No sanitization or validation of the content of the project files is performed before processing.
Audit Metadata