syncfusion-wpf-markdown-viewer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited syncfusion-wpf-markdown-viewer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The SfMarkdownViewer renders Markdown content — headings, lists, links, images, tables, code blocks, and block quotes — into a styled WPF visual. Use it to display documentation, release notes, help content, README files, or any Markdown-based content without external rendering engines.
⚠️ Out of scope: Do not use this skill to load Markdown directly from arbitrary third-party URLs or unvalidated user input without fetching, validating, and sanitizing the content in application code first.
<Window
x:Class="GettingStarted.MainWindow"
xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
xmlns:markdown="clr-namespace:Syncfusion.UI.Xaml.Markdown;assembly=Syncfusion.SfMarkdownViewer.WPF"
xmlns:system="clr-namespace:System;assembly=mscorlib">
<Grid>
<markdown:SfMarkdownViewer Source="# Hello World This is **bold** and *italic* text." />
</Grid>
</Window>using Syncfusion.UI.Xaml.Markdown;
SfMarkdownViewer markdownViewer = new SfMarkdownViewer();
markdownViewer.Source = "# Hello World\n\nThis is **bold** and *italic* text.";
this.Content = markdownViewer;📄 Read: references/getting-started.md
📄 Read: references/loading-content.md
📄 Read: references/events.md
app:// links📄 Read: references/mermaid-diagrams.md
| Property | Type | Purpose |
|---|---|---|
Source | string | Raw Markdown string, file path, or HTTP/HTTPS URL |
MermaidBlockTemplate | DataTemplate | Custom template for rendering mermaid code blocks |
| Event | Args | Purpose |
|---|---|---|
HyperlinkClicked | MarkdownHyperlinkClickedEventArgs | Fires when user clicks a hyperlink in rendered Markdown |
Source directly.md file bundled with the application (not a path from user input) and assign its text to SourceSource — never pass a third-party URL directly to SourceMermaidBlockTemplate with SfDiagram to render flowcharts; validate the Mermaid DataContext string (length and type prefix) before calling LoadDiagramFromMermaid()HyperlinkClicked with cancel-by-default; validate app:// routes against an explicit allowlist and only permit https:// external links| Risk | Mitigation |
|---|---|
| Remote URL loads untrusted third-party Markdown | Fetch content in app code; validate origin (allowlisted base URL) and content-type before assigning to Source |
| Hyperlink in Markdown drives unintended navigation | Use cancel-by-default in HyperlinkClicked; validate app:// routes against a fixed allowlist; only permit https:// external links |
| Mermaid block from untrusted Markdown drives diagram rendering | Validate DataContext string: check non-null, enforce length limit, allowlist diagram type prefixes before calling LoadDiagramFromMermaid() |
User-supplied URL passed to Source | Never accept URLs from user input or third-party data as-is; always validate origin in application code first |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.