devextreme-checkbox
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill integrates with MCP tools to fetch external documentation from the vendor's official website. This creates a potential surface for indirect prompt injection if the fetched content were to contain malicious instructions. However, the skill provides clear mitigation directives for the agent to treat fetched data as reference only and ignore any embedded commands.
- Ingestion points: Documentation content retrieved via devexpress_docs_search and devexpress_docs_get_content tools described in SKILL.md.
- Boundary markers: Explicit instructions in SKILL.md for the agent to ignore and report directives found in reference material.
- Capability inventory: The skill is limited to UI code generation for Angular, React, Vue, and jQuery.
- Sanitization: Behavioral constraints are in place to ensure external content does not override the agent's instructions.
- [SAFE]: All dependencies (devextreme-angular, devextreme-vue, devextreme-react, devextreme) and documentation links point to the recognized official infrastructure of the vendor.
Audit Metadata