devexpress-reports-blazor
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute
dotnet list packageas part of its automated discovery phase to identify installed DevExpress packages and their versions. - [EXTERNAL_DOWNLOADS]: The skill guides the installation of several third-party libraries via NuGet, including DevExpress., SkiaSharp., and HarfBuzzSharp.*. It also references sample JSON data hosted on GitHub (raw.githubusercontent.com/DevExpress-Examples/DataSources/master/JSON/customers.json). These are standard dependencies for Blazor reporting applications.
- [DYNAMIC_EXECUTION]: The skill involves report deserialization from XML (REPX files) using
XtraReport.FromXmlStream. It correctly identifies the security risks associated with untrusted type deserialization and provides detailed instructions on implementingDeserializationSettings.RegisterTrustedClassto mitigate these risks. - [INDIRECT_PROMPT_INJECTION]: The skill performs discovery by reading project files (
.csproj,Program.cs,appsettings.json) and terminal output (dotnet list package). While this exposes an ingestion surface for untrusted data, the skill is designed to process this data for configuration purposes rather than immediate execution, and the risk is managed.
Audit Metadata