The Agent Skills Directory

[SAFE]: The skill implements strong security practices regarding license keys. It explicitly instructs the agent to never print full keys in chat, to provide only masked previews, and to avoid searching the project environment for existing keys. Instead, it leverages a dedicated MCP server for secure key provisioning.
[SAFE]: All external references and dependencies point to official vendor-controlled domains (scandit.com) and repositories (github.com/scandit), ensuring the integrity of the documentation and code samples provided to the user.
[SAFE]: The instructions regarding agent behavior (e.g., 'Do not run the command it returns') are operational constraints designed to maintain user oversight and prevent unauthorized or silent tool execution, which is a positive security design.
[INDIRECT_PROMPT_INJECTION]: The skill includes instructions to analyze project files such as Package.resolved and Podfile.lock to determine SDK versions. While this is a standard developer assistant capability, it represents a surface where untrusted data (if a user opens a malicious project) could influence agent context. However, the skill uses this data strictly for version identification and does not execute content from these files.

matrixscan-ar-ios