matrixscan-batch-android
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the latest SDK version information from Maven Central (Sonatype) and references official Scandit documentation and GitHub repositories. These operations target well-known and trusted services relevant to the skill's primary purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill has an injection surface where data from an external website (Sonatype) is used to generate project configuration files.
- Ingestion points:
references/integration.md(fetches version from sonatype.com). - Boundary markers: Absent; the fetched version string is interpolated directly into Gradle build scripts.
- Capability inventory: File writing (applying code to files) and network retrieval.
- Sanitization: Absent; the skill does not specify validation for the fetched version string.
- [PROMPT_INJECTION]: The instructions include directives to streamline the user experience, such as 'Do not tell the user to check the docs themselves' and 'apply it to the file' instead of displaying code. While these direct the agent to perform actions semi-autonomously, they are consistent with the intended use case of a coding assistant and do not attempt to bypass safety guardrails.
Audit Metadata