devexpress-office-file-api-spreadsheet
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external spreadsheet files (.xlsx, .xls, .csv, .txt), which serves as an ingestion point for untrusted data and potential indirect prompt injection attacks.\n
- Ingestion points: Untrusted files are loaded using the
workbook.LoadDocumentmethod, as shown inSKILL.mdandreferences/getting-started.md.\n - Boundary markers: The skill does not define specific text delimiters for prompt boundaries but focuses on API-level data handling.\n
- Capability inventory: The API possesses capabilities for file system writes (
SaveDocument), data rendering (ExportToPdf), and complex calculation of workbook formulas.\n - Sanitization: The
references/safe-spreadsheet-processing.mdguide provides high-quality remediation instructions for usingWorkbookSecurityLoadingLimits(DoS protection) andWorkbookSecurityLoadingOptionsto strip macros, OLE objects, and external connections during the load process.\n- [EXTERNAL_DOWNLOADS]: The skill references official DevExpress NuGet packages for its core functionality.\n - Evidence: It specifies
DevExpress.Document.Processor,DevExpress.Drawing.Skia, andDevExpress.Pdf.SkiaRenderer. These are recognized vendor resources from DevExpress and are considered safe for use in this context.
Audit Metadata