matrixscan-pick-kmp
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user requirements (such as symbology lists and product data structures) to generate and apply code to the local project filesystem. While this represents a functional capability of the agent, it creates a surface for indirect instructions.
- Ingestion points: User-supplied symbology types and product identifiers processed in
SKILL.mdandreferences/integration.md. - Boundary markers: None explicitly defined for interpolating user-supplied strings into code templates.
- Capability inventory: The skill instructs the agent to apply generated Kotlin and Swift code to local project files.
- Sanitization: Standard for development assistance; no specific sanitization of user-supplied code snippets is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill references external dependencies from well-known and vendor-owned sources.
- Evidence: Directs the agent to Maven artifacts on
central.sonatype.comand Swift packages from Scandit's official repositories. These are standard practices for third-party SDK integration and originate from the vendor and established package registries.
Audit Metadata