scandit-sdk@2f0731a
CAUTIONPublisher claims: "AI agent skills for integrating the Scandit Data Capture SDK — product selection, documentation, and implementation guides for barcode scanning, ID capture, and smart label capture." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Claude Code plugin marketplacePublisher scandit · joined 0 days agoInstalls 0Last detonated 1 h ago
Is scandit-sdk@2f0731a safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
MEDIUM
npx invocation of non-well-known packageskills/label-capture-capacitor/SKILL.md:23 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packageskills/barcode-capture-rn/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionskills/matrixscan-batch-cordova/SKILL.md:50 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packageskills/matrixscan-ar-capacitor/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionskills/matrixscan-ar-cordova/SKILL.md:48 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packageskills/label-capture-rn/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionskills/matrixscan-ar-capacitor/SKILL.md:49 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packageskills/matrixscan-ar-rn/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionskills/barcode-capture-cordova/SKILL.md:44 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
Auto-update or dynamic fetch configurationskills/barcode-capture-flutter/SKILL.md:26 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packageskills/data-capture-sdk/SKILL.md:85 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packageskills/matrixscan-batch-rn/SKILL.md:26 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packageskills/matrixscan-count-rn/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packageskills/sparkscan-rn/SKILL.md:20 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionskills/sparkscan-capacitor/SKILL.md:42 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packageskills/sparkscan-capacitor/SKILL.md:20 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionskills/sparkscan-cordova/SKILL.md:42 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07What would make this Verified
1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim scandit: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to Claude Code plugins, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim scandit