barcode-capture-net-android
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the latest package versions from NuGet.org (
https://www.nuget.org/packages/Scandit.DataCapture.Barcode/) and the NuGet API. It also references official documentation from Scandit (docs.scandit.com). These are well-known and trusted sources. - [COMMAND_EXECUTION]: Provides standard developer commands for project scaffolding using the
dotnetCLI (e.g.,dotnet new android). This is routine for developer-oriented skills. - [CREDENTIALS_UNSAFE]: The skill uses a dedicated protocol for license key management via MCP tools (
get_license_key,ensure_scanner_setup) and explicitly instructs the agent to mask keys in chat to prevent exposure. It correctly uses placeholders in code samples. - [INDIRECT_PROMPT_INJECTION]: The skill ingests version strings from the NuGet website. While this is an untrusted data source, the ingestion is limited to specific version fields for the purpose of pinning dependencies, posing a negligible risk of instruction injection.
- [PROMPT_INJECTION]: Static detectors flagged potential concealment attempts, but these are identified as false positives. The instructions to "never print a full key" and "mask previews" are security best practices to protect the user's license keys, not malicious attempts to hide actions from the user.
Audit Metadata