The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the latest stable SDK version from NuGet (a well-known package registry) and refers to official documentation on docs.scandit.com (vendor site). These references are standard development practices for SDK integration and target trusted/well-known sources.
[INDIRECT_PROMPT_INJECTION]: The skill defines a process where the agent ingests content from external websites (NuGet pages and official documentation) to inform code generation. This represents a potential attack surface if the external sources were compromised, but the risk is assessed as low given the sources are official vendor and registry domains.
Ingestion points: SKILL.md and references/integration.md (via WebFetch/browser from nuget.org and scandit.com).
Boundary markers: The skill provides specific instructions on how to parse the data (e.g., "read the latest stable version").
Capability inventory: The agent writes and modifies .csproj files and C# source code.
Sanitization: No explicit sanitization logic is provided in the skill instructions; it relies on the agent's ability to extract specific version strings and API signatures.
[CREDENTIALS_UNSAFE]: The skill includes explicit security constraints for handling Scandit license keys. It instructs the agent to mask keys in chat and prohibits searching the local project environment for keys. These are protective measures designed to prevent accidental exposure of sensitive data.

barcode-capture-net-maui