matrixscan-batch-capacitor
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing barcode data, which is external, untrusted input that could potentially contain malicious instructions. \n
- Ingestion points: The
didUpdateSessionlistener described inreferences/integration.mdreceives barcode data from the camera stream.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used for the raw barcode content processed in the samples.\n
- Capability inventory: The code examples demonstrate using
console.logand rendering AR overlays usingTrackedBarcodeView.withHTMLElement.\n - Sanitization: The provided code examples correctly use
textContentwhen injecting barcode data into DOM elements, which is a secure practice to prevent script injection in the user interface.\n- [COMMAND_EXECUTION]: The skill instructs the user to execute standard shell commands required for mobile development and dependency management.\n - Evidence:
references/integration.mdandreferences/migration.mdinclude instructions fornpm install,npm uninstall, andnpx cap sync.\n- [EXTERNAL_DOWNLOADS]: The skill references and installs official libraries and documentation from the vendor.\n - Evidence: The skill facilitates the installation of
scandit-capacitor-datacapture-*packages from the NPM registry and links to official documentation atdocs.scandit.comand sample code on the vendor's official GitHub repositories.
Audit Metadata