label-capture-flutter
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions to mask license keys in chat and avoid printing them in full. While flagged by automated detectors as a concealment pattern, this is a security best practice designed to prevent the accidental exposure of sensitive credentials in logs or chat history.
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill includes a defined protocol for handling license keys using specific tools (
ensure_scanner_setup,get_license_key). It explicitly forbids the agent from searching the local filesystem or environment for keys, reducing the risk of accidental credential leakage. All code examples use placeholders for sensitive values. - [INDIRECT_PROMPT_INJECTION]: As a tool designed to extract data from physical labels (OCR and Barcode scanning), the skill naturally interacts with untrusted external data. The instructions provide guidance on using regular expressions for field extraction, which acts as a primary validation layer. While the ingestion of external text is an inherent attack surface for any scanning tool, the skill does not introduce unsafe processing of this data by the agent itself.
- [EXTERNAL_DOWNLOADS]: The skill references official Scandit documentation and GitHub repositories. All package dependencies mentioned (
scandit_flutter_datacapture_label, etc.) are official vendor libraries matching the author's identity.
Audit Metadata