matrixscan-batch-net-android

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, the application code registers IBarcodeBatchListener/SessionUpdated and receives decoded barcode text via session.AddedTrackedBarcodes → tb.Barcode.Data in OnSessionUpdated, which is outsider-controlled (from the camera’s observed real world) free text fed into the app.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires a runtime WebFetch of the NuGet package page (https://www.nuget.org/packages/Scandit.DataCapture.Barcode/) — with a fallback to https://api.nuget.org/v3-flatcontainer/scandit.datacapture.barcode/index.json — to read the exact stable SDK version and pin package references, so those external URLs directly control the agent's actions and outputs.