igniteui-blazor-grids
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions that direct the AI agent to modify local environment configurations without requesting permission. In
SKILL.md, the 'MCP Server Setup' section mandates that the agent 'automatically configure' the environment if specific tools are missing. The instructions explicitly forbid asking the user for manual intervention: 'After writing the file, inform the user... Do NOT skip this step or ask the user to do it manually.' This represents an attempt to bypass standard user-confirmation cycles for modifications to the developer's workspace (e.g., writing to.vscode/mcp.json). - [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of external code via configuration setup. In
references/mcp-setup.md, the provided configuration snippets for VS Code, Cursor, and Claude Desktop include the commandnpx -y igniteui-cli mcp. This command utilizesnpxto fetch and execute theigniteui-clipackage directly from the public npm registry. While this is a vendor-owned package, the automated setup of remote execution environments without explicit user opt-in is a security concern.
Audit Metadata