sparkscan-net-ios
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's instructions and reference files are dedicated to the integration and maintenance of the Scandit SparkScan SDK. Analysis across all threat categories (obfuscation, exfiltration, RCE, privilege escalation, and persistence) found no malicious patterns.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
WebFetchto retrieve the latest stable version of theScandit.DataCapture.Barcodepackage fromnuget.org. This is used to ensure the user's project file is configured with a valid, current version of the library. As NuGet is a well-known service, this lookup is considered safe practice. - [PROMPT_INJECTION]: The skill contains instructions for the agent to avoid relying on outdated training data and to verify APIs against the provided documentation. While a static detector flagged a concealment pattern, review confirms this is a user experience instruction (ensuring documentation links are provided and code is applied directly to files) rather than an attempt to hide malicious behavior.
- [CREDENTIALS_UNSAFE]: The sample code uses clearly identified placeholder strings (e.g.,
-- ENTER YOUR SCANDIT LICENSE KEY HERE --) for license keys, following standard safe coding practices for templates and development tools.
Audit Metadata