devexpress-dashboard-data-sources
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill integrates with an MCP server (
dxdocs) to fetch external documentation. While this introduces a potential attack surface where fetched content could contain malicious instructions, the skill includes explicit defensive instructions to treat fetched content strictly as reference material and to ignore any behavioral directives or command requests found within it. - [EXTERNAL_DOWNLOADS]: The documentation references and code samples point to official vendor resources for configuration and demonstration purposes. This includes domains like
docs.devexpress.comand example data hosted onraw.githubusercontent.com/DevExpress-Examples/. These are established vendor-managed sources used for legitimate technical guidance. - [SAFE]: The skill demonstrates strong security posture by instructing the agent to maintain default security settings, such as keeping
PassCredentialsdisabled. It also provides guidance on implementingRegisterTrustedClass(Safe Deserialization) to mitigate risks associated with loading object data sources from untrusted XML definitions.
Audit Metadata