syncfusion-react-form-renderer
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and implementation guides for the @syncfusion/ej2-react-form-renderer package, which is a legitimate UI component from Syncfusion Inc.
- [EXTERNAL_DOWNLOADS]: Documentation examples reference remote data sources, including a vendor-owned domain (services.syncfusion.com) and a public mock API service (Beeceptor). These are used strictly for demonstration purposes within the code samples.
- [DYNAMIC_EXECUTION]: The component supports a JSON-based expression engine for form logic, such as validations and calculated fields. This is a core feature of the documented library and does not allow for arbitrary code execution outside the component context.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an indirect injection surface where forms ingest remote data. The documentation accounts for this by providing an enableHtmlSanitizer property and explicitly mentioning its default behavior to ensure developers can implement appropriate security controls.
Audit Metadata