id-capture-rn
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The instructions prioritize the provided reference documentation to ensure the AI agent uses correct API signatures, which is a standard technique for technical skills. Static analysis hints regarding concealment are identified as false positives, as they refer to security-positive instructions for masking sensitive license keys in the user interface.
- [EXTERNAL_DOWNLOADS]: The skill references official Scandit documentation, GitHub sample repositories, and license management portals. These resources are authenticated vendor assets necessary for the skill's primary function of SDK integration.
- [DATA_EXFILTRATION]: The skill includes explicit warnings against logging personally identifiable information (PII) captured during the ID scanning process. It also prescribes secure handling of license keys via an MCP server or masked user input, preventing accidental credential exposure.
- [COMMAND_EXECUTION]: The documentation describes standard React Native and Expo CLI commands used for building and managing mobile projects. These commands are typical for development environments and do not involve unauthorized or suspicious shell operations.
- [INDIRECT_PROMPT_INJECTION]: While the skill handles identity document data, it provides specific guidance on safely surfacing this information within the application's UI while avoiding insecure logging practices, mitigating risks associated with untrusted data ingestion.
Audit Metadata