sparkscan-net-maui

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow wires a MAUI <scandit:SparkScanView> and processes the scanned barcode’s barcode.Data in SparkScan.BarcodeScanned / ISparkScanFeedbackDelegate.GetFeedbackForBarcode, meaning outsider-authored free text (a barcode’s payload) is ingested by the app when scanned.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to WebFetch the NuGet package page (https://www.nuget.org/packages/Scandit.DataCapture.Barcode.Maui/) and, on failure, the NuGet flat container index (https://api.nuget.org/v3-flatcontainer/scandit.datacapture.barcode.maui/index.json) at runtime to read the authoritative stable package version and then inject that version into generated project files, so external content directly controls the produced code/dependencies.