matrixscan-batch-cordova

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to retrieve a Scandit license key via MCP and then explicitly write it into the code in place of a placeholder, creating an exfiltration risk as the secret passes through the LLM's context and output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill documentation references the remote Scandit MCP server at https://ssl.scandit.com/mcp and license endpoints at https://ssl.scandit.com as operational setup/authentication paths, which constitutes a common/reputable unofficial external dependency.