matrixscan-ar-net-android

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the .NET Android runtime path, the agent consumes barcode text coming from the device camera feed via BarcodeAr.SessionUpdated → TrackedBarcode.Barcode.Data (and may further render it through IBarcodeArHighlightProvider.HighlightForBarcodeAsync / IBarcodeArAnnotationProvider.AnnotationForBarcodeAsync).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to WebFetch live package and API documentation pages at runtime (e.g. https://www.nuget.org/packages/Scandit.DataCapture.Barcode/ and https://docs.scandit.com/data-capture-sdk/dotnet.android/barcode-capture/api.html), so remote content fetched during runtime directly controls the agent's guidance (package version and API details).