barcode-capture-ios
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructions specify that the agent should prioritize provided reference materials over its internal training data to ensure API accuracy. The instructions also direct the agent to perform file edits directly rather than just outputting code in chat. These are standard operational instructions for developer-focused agents and do not represent attempts to bypass safety protocols or hide malicious behavior.
- [EXTERNAL_DOWNLOADS]: The skill references the official Scandit Swift Package Manager (SPM) repository (
https://github.com/Scandit/datacapture-spm) and documentation site (docs.scandit.com). These are legitimate vendor resources belonging to the author 'scandit' and are necessary for the skill's primary function of SDK integration. - [CREDENTIALS_UNSAFE]: Code templates within the skill and its fixtures use clear placeholders for license keys (e.g.,
-- ENTER YOUR SCANDIT LICENSE KEY HERE --). There are no hardcoded secrets or instructions to capture or exfiltrate user credentials. - [INDIRECT_PROMPT_INJECTION]: The skill acts on user-provided code files (e.g.,
ViewController.swift) and dependency manifests (e.g.,Package.resolved). While this ingestion of external data is a standard vector for indirect injection, the skill's logic is constrained to code refactoring and providing SDK-specific guidance. It lacks high-risk capabilities like arbitrary shell execution or data exfiltration that would make this surface exploitable.
Audit Metadata