The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes barcode data from external sources, which serves as an ingestion point for untrusted content.
Ingestion points: The BarcodeBatchListener.onSessionUpdated and BarcodeBatchAdvancedOverlayListener.viewForTrackedBarcode functions in references/integration.md process the TrackedBarcode.barcode.data field.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the agent when handling barcode content.
Capability inventory: The skill does not currently define subprocess execution or file-writing capabilities, which mitigates the risk of successful injection.
Sanitization: No explicit validation or sanitization steps are documented for the barcode data before it is used to update the application state or UI.
[EXTERNAL_DOWNLOADS]: The skill references official vendor dependencies for project setup.
Downloads Kotlin Multiplatform artifacts from Maven Central under the com.scandit.datacapture.kmp group.
References the Scandit/datacapture-kmp-spm Swift package for iOS project integration.
[CREDENTIALS_UNSAFE]: The skill includes specific guidelines for managing Scandit license keys to prevent accidental exposure.
Explicitly instructs the agent to provide only masked previews of license keys in chat and prohibits searching the project or environment for secrets.
Directs the use of the vendor's MCP server at ssl.scandit.com for trial license provisioning.

matrixscan-batch-kmp