The Agent Skills Directory

[SAFE]: The skill provides integration instructions for official Scandit SDK components. A static analysis hint regarding 'concealment' was evaluated as a false positive, as it refers to the standard security practice of masking license keys and preventing their exposure in chat logs.
[EXTERNAL_DOWNLOADS]: The skill references official SDK assets hosted on cdn.jsdelivr.net under the @scandit organization. These are vendor-owned resources delivered through a well-known CDN service and are considered safe for their intended purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes barcode data captured from the camera. It explicitly mitigates potential security risks by instructing the developer to use textContent instead of innerHTML to prevent Cross-Site Scripting (XSS) attacks from malicious barcode payloads.
[CREDENTIALS_UNSAFE]: The skill handles license keys through a dedicated MCP server interface and includes specific instructions for the agent to avoid searching the user's local file system or environment for credentials, thereby protecting existing secrets.

matrixscan-batch-web