matrixscan-batch-capacitor

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing barcode data, which is external, untrusted input that could potentially contain malicious instructions. \n
  • Ingestion points: The didUpdateSession listener described in references/integration.md receives barcode data from the camera stream.\n
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used for the raw barcode content processed in the samples.\n
  • Capability inventory: The code examples demonstrate using console.log and rendering AR overlays using TrackedBarcodeView.withHTMLElement.\n
  • Sanitization: The provided code examples correctly use textContent when injecting barcode data into DOM elements, which is a secure practice to prevent script injection in the user interface.\n- [COMMAND_EXECUTION]: The skill instructs the user to execute standard shell commands required for mobile development and dependency management.\n
  • Evidence: references/integration.md and references/migration.md include instructions for npm install, npm uninstall, and npx cap sync.\n- [EXTERNAL_DOWNLOADS]: The skill references and installs official libraries and documentation from the vendor.\n
  • Evidence: The skill facilitates the installation of scandit-capacitor-datacapture-* packages from the NPM registry and links to official documentation at docs.scandit.com and sample code on the vendor's official GitHub repositories.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:33 PM
Security Audit — agent-trust-hub — matrixscan-batch-capacitor