barcode-capture-net-ios
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves package version metadata from the official NuGet gallery (
nuget.org) and technical references from the vendor's documentation portal (docs.scandit.com). These are trusted, well-known services for developer tooling. - [PROMPT_INJECTION]: Instructions in
SKILL.mddirect the agent to prioritize the provided reference files over its internal training data to ensure API accuracy. This is a common instructional override in documentation skills intended to prevent hallucinations regarding version-specific signatures. - [INDIRECT_PROMPT_INJECTION]: The skill operates on an indirect prompt injection surface by ingesting data from external web pages (NuGet) and user project files to generate source code. While this is standard for coding assistants, the following factors apply:
- Ingestion points: The agent fetches package information from
nuget.organd reads user-provided.csprojand C# files. - Boundary markers: The skill does not define explicit delimiters or "ignore embedded instructions" warnings for the ingested external data.
- Capability inventory: The skill utilizes file-writing capabilities to implement the scanning logic across several files (
AppDelegate.cs,ViewController.cs, and.csproj). - Sanitization: The skill assumes the integrity of fetched version strings and user-provided source code without implementing specific validation or escaping logic.
- [CREDENTIALS_SAFE]: The skill implements protective measures for handling license keys, including instructions for the agent to avoid searching the environment or project for keys and requiring a masked preview in chat to prevent accidental exposure.
Audit Metadata