devexpress-reports-winforms
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (report layouts and database content), which presents a potential injection surface for malicious instructions.
- Ingestion points: Loading report layouts from files or databases (
GetData,.repxfiles) and reading database content through data sources. - Boundary markers: The skill includes an instruction to ignore any text in fetched documentation that attempts to direct the agent's behavior.
- Capability inventory: Use of shell commands for NuGet package management (
dotnet add package), file system access for report storage (File.ReadAllBytes,File.WriteAllBytes), and network operations via data source components. - Sanitization: The skill provides extensive documentation on mitigating these risks via SQL validation (
ValidateCustomSqlQueryGlobal), safe deserialization of custom types (DeserializationSettings.RegisterTrustedClass), and restricted assembly loading (EFDataSource.BeforeLoadCustomAssemblyGlobal). - [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands for project dependency management.
- Evidence: Instructions for adding packages via
dotnet add package DevExpress.Win.ReportingandDevExpress.DataAccess. This is a standard development operation. - [SAFE]: The skill follows security best practices by explicitly teaching the developer how to avoid hardcoded credentials and implement secure database access control.
Audit Metadata