devextreme-textbox
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a feature to fetch external content using the
devexpress_docs_get_contenttool. This introduces a surface for indirect prompt injection if the source documentation were to contain malicious instructions. The skill proactively addresses this by providing explicit instructions to the agent to treat fetched content strictly as reference data, ignore any embedded directives or commands, and notify the user if suspicious content is detected. - [SAFE]: The skill uses official packages and resources belonging to the 'devexpress' vendor, including
devextreme-react,devextreme-angular, anddevextreme-vue. No patterns of obfuscation, credential harvesting, unauthorized persistence, or privilege escalation were found. The use of host-agent interaction tools is handled within standard safety guidelines.
Audit Metadata