agent-onboarding
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill implements strong safeguards against secret exposure. It explicitly instructs the agent to never echo, print, or commit license keys or API keys found in the environment or repository, directing the use of environment variables and secret management instead.
- [REMOTE_CODE_EXECUTION]: Installation of additional agent skills and product libraries is performed through official channels using commands like
npx skills add syncfusion/<repository>and standard package managers. The repositories are verified vendor-owned locations. - [DYNAMIC_EXECUTION]: Configuration for Model Context Protocol (MCP) servers involves running vendor-provided packages from npm/NuGet. These operations are limited to official Syncfusion tools and are part of the intended developer workflow.
- [COMMAND_EXECUTION]: The skill executes package manager commands to ensure proper dependency resolution and lockfile updates. It explicitly prohibits manual manifest editing to prevent environment drift and build failures.
Audit Metadata