dynamsoft-sdk

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes hardcoded trial license keys for the Dynamsoft SDK in multiple files, including template-optimizer/tools/dbr_license.py and references/dcv.md. These are explicitly labeled as public trial keys intended for development and testing purposes.\n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill defines project dependencies for standard libraries such as opencv-python, numpy, and zxing-cpp, as well as the official vendor SDK dynamsoft-capture-vision-bundle. It provides instructions for manual report generation using local Node.js commands but does not perform automatic remote script execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface as it processes external image data and user-provided JSON templates to optimize barcode recognition.\n
  • Ingestion points: Image files and directory paths processed by template-optimizer/tools/validate_dbr_template.py and template-optimizer/resources/harness_py/main.py.\n
  • Boundary markers: The instructions provide clear operating rules and diagnostic steps (e.g., "Observe before editing") to guide the agent's behavior.\n
  • Capability inventory: The skill performs file system writes (generating reports and optimized templates) and image processing via OpenCV.\n
  • Sanitization: Data is processed using standard libraries such as the json module and cv2 for image handling, minimizing the risk of arbitrary instruction execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 03:20 AM
Security Audit — agent-trust-hub — dynamsoft-sdk