syncfusion-aspnetmvc-scheduler
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches CSS and JavaScript resources from the official Syncfusion CDN (
cdn.syncfusion.com). As Syncfusion is the vendor of the component described, these downloads are considered standard and safe for the intended functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-contributed content such as appointment subjects, descriptions, and imported iCalendar (.ics) files, which represents an indirect prompt injection surface. However, the skill explicitly provides instructions and code examples for mitigating this risk, including the use of
@Html.Encodein views andHtmlEncoder.Default.Encodein server-side controllers to prevent cross-site scripting (XSS). - Ingestion points: Data enters the system via remote API endpoints, user input fields in the appointment editor, and external file imports (iCalendar).
- Boundary markers: The documentation recommends using explicit data models and mapping fields to structure the input.
- Capability inventory: The skill involves database storage (CRUD) and network operations (data binding), but does not execute arbitrary shell commands or access sensitive system files.
- Sanitization: The skill demonstrates robust sanitization practices, including server-side model validation, HTML encoding, and anti-forgery tokens (CSRF protection).
- [COMMAND_EXECUTION]: The provided code examples are limited to C# and JavaScript application logic for the Syncfusion component. There are no patterns suggesting arbitrary command execution or subprocess spawning.
- [DATA_EXFILTRATION]: Network operations are scoped to localized API endpoints (e.g.,
/api/events) and the official Syncfusion CDN. No data is sent to unknown or suspicious third-party domains.
Audit Metadata