Audit Common Skill Rules
Use when the user wants to verify that the universal trust-and-verification rules are present in every Scandit SDK skill in this repo. Triggered by "audit common skill rules", "check rule consistency across skills", or "audit skills for missing trust rules".
Install
$ agentstack add skill-scandit-skills-audit-common-skill-rules ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-scandit-skills-audit-common-skill-rules) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Audit Common Rules
Walks every skills/*/SKILL.md and reports which ones are missing required content. Read-only — never edit files.
Wording may vary per product and platform (e.g. SparkScan API vs BarcodeCapture API; view modifiers on iOS vs plugin names on Capacitor). The audit checks whether each required rule is conveyed, not that it matches verbatim.
How to run
- List every
skills/*/SKILL.md, skippingskills/audit-common-rules/, anyskills/_*directory, and the per-section exempts below. - For each skill, check whether each required H2 exists and conveys every required rule.
- Output a report:
- Compliant: list of skill names.
- Issues: one row per problem —
· · ·. The `is eitherMISSING_SECTIONor a short paraphrase of the missing rule (e.g.missing "fetch-when-missing"`). Group identical issues across many skills into a single row with a skill list. - Totals.
Required content
1. ## Critical: Do Not Trust Internal Knowledge
Must exist and convey:
- Training data may contain outdated or incorrect Scandit SDK APIs.
- Always verify APIs against the references in this skill before writing or suggesting code.
- Do not rely on memorized method signatures, parameters, or platform-specific surface terms.
Exempt: data-capture-sdk (advisory skill, different trust rule).
2. ## API Usage Policy
Must exist and convey:
- Only use APIs documented in this skill's references.
- Do not invent or guess method signatures or parameters.
- Fetch the relevant reference page when unsure or on a compile error.
- Do not tell the user to check the docs themselves.
- Always include the relevant link in the answer.
- Never construct or guess documentation URLs — first check a fetched page for a direct hyperlink, otherwise fetch the API index and extract the real link.
Exempt: data-capture-sdk.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Scandit
- Source: Scandit/skills
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.