dynamsoft-sdk
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes hardcoded trial license keys for the Dynamsoft SDK in multiple files, including
template-optimizer/tools/dbr_license.pyandreferences/dcv.md. These are explicitly labeled as public trial keys intended for development and testing purposes.\n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill defines project dependencies for standard libraries such asopencv-python,numpy, andzxing-cpp, as well as the official vendor SDKdynamsoft-capture-vision-bundle. It provides instructions for manual report generation using local Node.js commands but does not perform automatic remote script execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface as it processes external image data and user-provided JSON templates to optimize barcode recognition.\n - Ingestion points: Image files and directory paths processed by
template-optimizer/tools/validate_dbr_template.pyandtemplate-optimizer/resources/harness_py/main.py.\n - Boundary markers: The instructions provide clear operating rules and diagnostic steps (e.g., "Observe before editing") to guide the agent's behavior.\n
- Capability inventory: The skill performs file system writes (generating reports and optimized templates) and image processing via OpenCV.\n
- Sanitization: Data is processed using standard libraries such as the
jsonmodule andcv2for image handling, minimizing the risk of arbitrary instruction execution.
Audit Metadata