barcode-capture-web
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads official Scandit SDK components from the well-known jsDelivr CDN (
https://cdn.jsdelivr.net/npm/@scandit/web-datacapture-barcode@8/sdc-lib/). This is a standard practice for web-based library integration. - [PROMPT_INJECTION]: The static analysis flagged instructions directing the agent not to refer users to external documentation. In context, this is a benign instruction aimed at ensuring the agent provides direct answers using the skill's reference files, rather than a malicious attempt to conceal behavior or bypass safety filters.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of data from scanned barcodes, which constitutes untrusted external input.
- Ingestion points: Barcode data is ingested via the
didScanevent handler defined inreferences/integration.md. - Boundary markers: The skill provides strict API usage guidelines and explicit code templates to manage data flow.
- Capability inventory: The functionality is confined to standard browser-based barcode capture, UI updates, and console logging. No dangerous capabilities such as file-system writes, shell command execution, or network exfiltration to unknown domains are present.
- Sanitization: Scanned data is handled as standard strings for UI and logging purposes without being passed to sensitive sinks.
Audit Metadata