skills/syncfusion/aspnetcore-ui-components-skills/syncfusion-aspnetcore-markdown-converter/Gen Agent Trust Hub
syncfusion-aspnetcore-markdown-converter
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface where malicious instructions or scripts could be embedded in the processed Markdown data.
- Ingestion points: Markdown content is ingested from user-controlled sources, such as HTML textareas or server-side variables passed to the view (referenced in references/richtexteditor-integration.md and references/tohtml-api.md).
- Boundary markers: Absent. The instructions do not provide delimiters or instructions to the agent to treat the input as untrusted data.
- Capability inventory: The skill uses client-side DOM manipulation by assigning the converter's output directly to the innerHTML property of preview elements (referenced in SKILL.md and references/getting-started.md).
- Sanitization: Absent. The documentation does not specify if the MarkdownConverter.toHtml method performs internal sanitization, nor does it provide guidance on using a separate library to sanitize the resulting HTML before rendering it in the browser.
- [EXTERNAL_DOWNLOADS]: The skill references external CSS and JavaScript files for the library's core functionality and styling.
- Evidence: Fetches resources from https://cdn.syncfusion.com/ej2/{{ site.ej2version }}/fluent.css and https://cdn.syncfusion.com/ej2/{{ site.ej2version }}/dist/ej2.min.js.
- These resources are hosted on the official vendor CDN belonging to Syncfusion Inc.
Audit Metadata