matrixscan-batch-flutter
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure practices by using placeholders for sensitive credentials (license keys) and providing robust lifecycle management instructions to prevent resource leaks.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a system for scanning and processing barcode data, which serves as a potential vector for indirect prompt injection.
- Ingestion points: Barcode data is retrieved from
session.trackedBarcodesandsession.addedTrackedBarcodeswithin thedidUpdateSessioncallback inreferences/integration.md. - Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from interpreting text within a barcode as instructions.
- Capability inventory: The skill's functionality and the code it generates are restricted to UI state updates, logging (
debugPrint), and SDK configuration. It lacks high-risk capabilities such as arbitrary file system access, network exfiltration of local data, or command execution. - Sanitization: The provided integration examples do not perform sanitization on the barcode data before processing.
Audit Metadata