skills/syncfusion/aspnetcore-ui-components-skills/syncfusion-aspnetcore-markdown-converter/Gen Agent Trust Hub
syncfusion-aspnetcore-markdown-converter
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill describes patterns for converting user-supplied Markdown to HTML and injecting it directly into the web page's DOM using the
innerHTMLproperty. This creates a surface for indirect prompt injection where malicious input could execute arbitrary scripts in the user's browser context. - Ingestion points: User-controlled input from the Rich Text Editor or textareas (e.g., in
references/richtexteditor-integration.md). - Boundary markers: None; untrusted input is passed directly to the conversion function.
- Capability inventory: Client-side DOM manipulation via
innerHTMLacross multiple integration examples. - Sanitization: The documentation does not specify or demonstrate HTML sanitization of the converter's output before rendering.
- [SAFE]: The skill references legitimate assets including the
Syncfusion.EJ2.AspNet.CoreNuGet package and scripts from thecdn.syncfusion.comdomain, which are official resources provided by the vendor.
Audit Metadata