syncfusion-javascript-common

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of numerous NPM packages from the official @syncfusion scope and clones example repositories from the official SyncfusionExamples GitHub organization.
  • [EXTERNAL_DOWNLOADS]: Retrieves CSS stylesheets, themes, and icon assets from the vendor's Content Delivery Network (cdn.syncfusion.com).
  • [COMMAND_EXECUTION]: Provides instructions for activating product licenses using the npx syncfusion-license activate command and managing the SYNCFUSION_LICENSE environment variable across different operating systems.
  • [COMMAND_EXECUTION]: Recommends persisting the license key by appending export statements to shell profiles like ~/.bash_profile on macOS/Linux or using setx on Windows for development environment configuration.
  • [PROMPT_INJECTION]: Components such as the Grid and ListView utilize templates (string, script, and function based) to render data from dataSource objects. This creates an attack surface for indirect prompt injection or cross-site scripting (XSS) if the provided data is untrusted and unsanitized. The documentation addresses this by highlighting built-in HTML sanitization features and security best practices.
  • [DATA_EXFILTRATION]: Includes a state persistence feature (enablePersistence) that stores user-specific UI configurations (e.g., column ordering, paging state) in the browser's localStorage for continuity across sessions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 09:54 AM