label-capture-rn

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs the agent to fetch and read external public documentation and sample code (e.g., docs.scandit.com API pages and the GitHub LabelCaptureSimpleSample) when verifying APIs or finding links, so runtime behavior depends on untrusted third-party web content the agent must interpret.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly requires fetching and following external documentation at runtime (e.g. https://docs.scandit.com/sdks/react-native/label-capture/get-started/), so live content from that URL would directly influence the agent's prompts and code suggestions.