label-capture-capacitor
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed technical instructions for integrating the Scandit SDK, including mandatory initialization steps like
ScanditCaptureCorePlugin.initializePlugins()and handling Capacitor's specific UI layering via thewebViewContentOnTopproperty. These are documented platform requirements, not malicious behavior. - [SAFE]: Data handling is performed within the context of the Scandit SDK's capture sessions. The skill explains how to retrieve camera frames using
getFrameDatafor legitimate auditing or cloud-processing purposes via the Adaptive Recognition Engine (ARE), which is clearly labeled as a beta feature requiring support activation. - [SAFE]: External dependencies are restricted to official Scandit packages (
scandit-capacitor-datacapture-*) and standard Capacitor plugins (@capacitor/app,@capacitor/camera). All reference links point to official Scandit domains (scandit.com) or their official GitHub organization. - [SAFE]: Credentials management is handled securely by advising the use of placeholders for license keys and providing a link to the official customer portal for key generation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (captured label fields). The ingestion points are the listener methods (
didCaptureLabelWithFields), and the capabilities involve processing and displaying this data. While the skill instructs the agent on how to format these results, the underlying SDK uses structured data and regex-based extraction which provides a layer of validation. The risk is considered low and inherent to the scanning functionality.
Audit Metadata