barcode-capture-kmp
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical integration guide for the Scandit SDK. All external links and dependencies point to legitimate vendor-owned infrastructure, including official documentation, Maven Central, and official GitHub repositories.
- [PROMPT_INJECTION]: A static detector flagged an instruction to mask license keys ("Show at most a masked preview in chat; never print a full key") as concealment. However, this is a standard security best practice for handling sensitive credentials in chat interfaces and does not represent a malicious attempt to hide agent actions from the user.
- [CREDENTIALS_UNSAFE]: The skill manages license keys securely by utilizing a specialized MCP server for trial provisioning and placeholders for application code. It explicitly instructs the agent not to search for credentials in the local project environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes barcode data, which is an external input. While this constitutes a potential injection surface common to all data-ingestion tools, the instructions do not implement any logic that would lead to unsafe execution or context leakage based on the scanned content.
Audit Metadata