syncfusion-aspnetcore-inputs
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) in its server-side code examples.
- Ingestion points: User-provided filenames from
IFormFile.FileNameand thefilesarray inHomeController.cs(documented inSKILL.md). - Boundary markers: Absent in the Quick Start and Getting Started sections.
- Capability inventory: Employs file system operations including
System.IO.File.Create,System.IO.File.Delete, andDirectory.CreateDirectoryacross multiple files. - Sanitization: The skill provides inconsistent guidance. While
references/uploader-advanced-patterns.mdandreferences/uploader-async-upload.mdinclude remediation steps like path validation, the primary "Quick Start" examples usePath.Combinedirectly with unsanitized user input, creating a vulnerability surface. - [EXTERNAL_DOWNLOADS]: The skill references front-end resources (CSS and JS) from
cdn.syncfusion.com. These are official assets from the vendor's own infrastructure and are documented as standard implementation practice.
Audit Metadata