label-capture-rn
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external label data through OCR and barcode scanning, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Physical labels (text and barcodes) captured via camera frames (SKILL.md, references/integration.md).
- Boundary markers: The skill use explicit LabelDefinition structures and regex patterns to delimit and validate captured fields.
- Capability inventory: Captured data is processed for display; no file-write or unauthorized network operations are triggered using the scan results.
- Sanitization: Input is filtered by regex and validated through the SDK's internal parsing logic.
- [EXTERNAL_DOWNLOADS]: The skill downloads official Scandit SDK components from npm and references documentation on official vendor domains. These are trusted sources for the intended development workflow.
- [COMMAND_EXECUTION]: Instructions include standard React Native commands like npm install and pod install for environment setup and dependency management.
- [SAFE]: The skill implements secret management best practices by instructing the agent to mask license keys and seek user consent for production credentials, preventing accidental exposure of sensitive information.
Audit Metadata