label-capture-ios
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official sample code and provides the Swift Package Manager (SPM) repository URL for the Scandit Data Capture SDK. All downloads originate from the vendor's verified GitHub organization (github.com/Scandit).
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data scanned from physical labels. While this represents an external data ingestion surface, it is considered safe in this context.
- Ingestion points: Data enters the application via the
LabelCaptureListenerandLabelCaptureValidationFlowDelegatemethods. - Boundary markers: The SDK provides structured data (
LabelField) that has already been validated against user-defined regex patterns. - Capability inventory: The provided code snippets only perform UI updates and data storage; no dangerous capabilities like shell execution, arbitrary file writes, or network exfiltration are used.
- Sanitization: Field values are strictly validated by the SDK's internal regex engine (
std::regex) before being passed to the application. - [SAFE]: The skill implements secure credential management by using placeholders for license keys and directing users to the official vendor portal to obtain their own credentials.
Audit Metadata