devexpress-dashboard-parameters
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to ingest external data through dashboard parameters and HTTP headers (e.g.,
ProductId). - Ingestion points: Data enters through the
DashboardParametersdialog and custom HTTP headers read viaIHttpContextAccessor. - Boundary markers: The skill utilizes standard framework delimiters such as
?parameterNameand[Parameters.name]to separate parameters from static expressions. - Capability inventory: The skill allows for SQL query execution and dashboard XML file operations via
DashboardFileStorage. - Sanitization: The instructions emphasize the use of
QueryParameterwithtypeof(Expression)for server-side filtering, which provides standard protection against SQL injection. It also explicitly warns that client-side visibility (Visible = false) is not a security boundary and recommendsCustomParametersfor identity-based filtering. - [EXTERNAL_DOWNLOADS]: The skill references official NuGet and npm packages from DevExpress. These are standard dependencies for the platform and originate from a well-known vendor, presenting no significant security risk.
- [COMMAND_EXECUTION]: The skill mentions running
dotnet buildto verify NuGet package consistency, which is a standard development task.
Audit Metadata