syncfusion-angular-form-builder
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill guides users to install necessary dependencies via npm, specifically targeting the @syncfusion scope, including @syncfusion/ej2-angular-form-builder and @syncfusion/ej2-material3-theme. These are legitimate vendor resources.\n- [INDIRECT_PROMPT_INJECTION]: The documented form schema allows for the interpolation of untrusted user input into expressions and query filters, representing a potential indirect prompt injection surface.\n
- Ingestion points: Untrusted data enters the context through form fields, which are then referenced in expressions, conditions, and custom validation rules using the {fieldName} syntax or the input keyword.\n
- Boundary markers: The documentation does not specify mandatory boundary markers or delimiters for user-provided strings within the expression engine.\n
- Capability inventory: The skill enables capabilities such as making network requests for data binding, calculating values dynamically via an expression engine, and rendering HTML content via specific widgets.\n
- Sanitization: The enableHtmlSanitizer property is available to sanitize untrusted HTML in templates, but it is configured to be false by default.\n- [DYNAMIC_EXECUTION]: The form builder evaluates logic defined in the expressionValue and customValidation schema properties at runtime. These strings are processed by the component's internal expression engine to derive values or validate state based on other field values.\n- [DATA_EXFILTRATION]: The skill includes examples of remote data binding that perform network operations to external endpoints. This includes vendor-hosted services and public mock API platforms like Beeceptor for demonstration purposes.
Audit Metadata