id-capture-android
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill includes explicit instructions for handling license keys securely. It directs the agent to only show masked previews of keys and specifically forbids printing full keys or searching for them in project files or environments.
- [DATA_EXPOSURE]: The skill provides privacy warnings to developers, such as 'personal data — never log it', when handling fields like full names and birth dates extracted from identity documents.
- [EXTERNAL_DOWNLOADS]: The instructions refer to official and well-known repositories, such as Maven Central (Sonatype), for fetching the Scandit SDK dependencies, which is standard practice for Android development.
- [PROMPT_INJECTION]: The skill contains instructions that prioritize provided reference files over internal training data ('Do Not Trust Internal Knowledge'). These are used to ensure technical accuracy across SDK versions and do not attempt to bypass safety filters or override core agent behavior.
- [COMMAND_EXECUTION]: The skill utilizes specific MCP tools (
ensure_scanner_setup,get_license_key) to assist with the developer's license configuration. It includes a safety constraint 'Do not run the command it returns', ensuring the agent provides information without executing unintended side effects.
Audit Metadata