matrixscan-batch-kmp
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains strong instructions ('Critical: Do Not Trust Internal Knowledge') directing the agent to ignore its training data in favor of provided references. This is a common technique used to improve accuracy and prevent the hallucination of API method signatures for new SDKs. The instruction to write code directly to files rather than just showing it in chat is a workflow directive for file-capable agents and does not constitute malicious concealment.
- [EXTERNAL_DOWNLOADS]: The skill references official dependencies on Maven Central (sonatype.com) and the vendor's documentation site (scandit.com). These are well-known and trusted sources for developer resources.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing barcode data at runtime, which is an inherent attack surface for scanning applications. However, the integration patterns shown follow standard development practices with no attempts to bypass security filters or execute unvalidated data.
- [CREDENTIALS_UNSAFE]: The skill uses clear placeholders ('-- ENTER YOUR SCANDIT LICENSE KEY HERE --') for API keys and license information, adhering to safe secret management practices.
Audit Metadata