syncfusion-vue-markdown-converter
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface where user-provided Markdown is converted to HTML and rendered directly into the DOM using innerHTML or Vue's v-html directive. * Ingestion points: User-provided text from the Rich Text Editor (references/richtexteditor-integration.md). * Boundary markers: None present in implementation examples to separate user data from HTML instructions. * Capability inventory: Direct DOM manipulation via innerHTML and v-html (SKILL.md, references/getting-started.md, references/tohtml-api.md). * Sanitization: The provided code examples do not include sanitization logic, although a security warning is provided in references/tohtml-api.md advising manual sanitization of untrusted input.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install multiple official libraries from the @syncfusion scope via npm, which is standard for using the vendor's components.
Audit Metadata