matrixscan-batch-capacitor
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate technical documentation, migration guides, and code examples for the Scandit Barcode Scanner SDK. All external resources, including NPM packages and URLs, originate from the official vendor infrastructure associated with the skill author.\n- [EXTERNAL_DOWNLOADS]: The skill references official NPM packages (scandit-capacitor-datacapture-core, scandit-capacitor-datacapture-barcode) and an official Scandit MCP server (ssl.scandit.com). These resources are recognized as trusted vendor assets based on the author's identity and matching domain patterns.\n- [SAFE]: The skill implements protective measures for user credentials by directing the agent to use a secure MCP environment for license key management. It explicitly instructs the agent to show only masked previews of keys and requires user consent before accessing production licenses. A static detector warning regarding concealment was reviewed and determined to be a false positive triggered by these security best practices.\n- [INDIRECT_PROMPT_INJECTION]: The skill interacts with user-provided code and external reference files, which constitutes a baseline attack surface for this type of agent skill. No specific malicious patterns or instructions were identified.\n
- Ingestion points: User project files (e.g., package.json, app.js) and internal reference markdown files.\n
- Boundary markers: Explicit intent routing logic in SKILL.md limits the scope of data ingestion to specific topics and tasks.\n
- Capability inventory: The skill performs code generation and calls specific MCP tools (ensure_scanner_setup, get_license_key) for configuration tasks.\n
- Sanitization: The skill provides clear templates and schemas for generated code, reducing the likelihood of processing or propagating malicious payloads.
Audit Metadata