matrixscan-pick-kmp
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides instructions for managing Scandit license keys. It mandates defensive practices, such as masking keys in chat outputs and forbidding the agent from scanning the local filesystem for credentials.
- [EXTERNAL_DOWNLOADS]: The skill references Maven artifacts for Kotlin Multiplatform (KMP) integration and a Swift Package Manager (SPM) repository. These resources are hosted on well-known platforms (Sonatype Central) or belong to the official vendor infrastructure.
- [PROMPT_INJECTION]: Static detectors flagged instructions related to the concealment of license keys. Analysis confirms these are protective measures designed to prevent the accidental exposure of sensitive information in logs or user interfaces, rather than attempts to bypass security filters.
Audit Metadata