sparkscan-web
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes robust instructions for handling Scandit license keys. It explicitly directs the agent to mask keys in chat and avoid searching the local environment for them, which is a positive security practice to prevent secret exposure.
- [EXTERNAL_DOWNLOADS]: The skill references official Scandit documentation, GitHub repositories, and well-known public CDNs (like jsDelivr) for fetching SDK components. These resources are reputable and consistent with the skill's primary purpose.
- [REMOTE_CODE_EXECUTION]: All code snippets provided, including a Python-based development server and React integration components, are standard implementations for their respective tasks. They use built-in libraries and official SDK methods without introducing risks.
- [PROMPT_INJECTION]: The static analysis flag for concealment is a false positive. The instructions to 'mask keys' and 'not tell the user to check docs' are operational constraints aimed at improving user experience and protecting sensitive data, rather than malicious attempts to bypass safety filters.
Audit Metadata