Is returning a new object without casting is risky ?

If there is any risk it is that the caller of the function may not delete the returned object, creating a memory leak.
So document the function properly (which you should always do) and state that the caller is responsible for cleaning up the returned object.

There is absolutely no casting required as new will return exactly the type you declared as return type. Maybe you are confusing this with malloc(), which returns a void* ?

The only thing I can think of that you might want to change, is catching possible exceptions from the constructor - if that is the purpose of your Create() function! You could for instance make a nothrow guarantee (see http://www.gotw.ca/gotw/059.htm[^]) like this:

XGGraphicAttribute* XGGraphicAttribute::Create() throw() {
   XGGraphicAttribute* result = 0;
   try {
      result = new XGGraphicAttribute;
   }
   catch (std::bad_alloc) {
      // memory allocation failed
      // send some out-of-memory notification
   }
   catch () {
      // contructor failed
      // send some notification, if you want to
   }
   return result;
}

Then again, it might be better to just let those exceptions hit the caller instead; that way there is no danger that the caller never thinks to test the result value - if the exception remains uncaught, it will immediately catch the attention of the developer, and (hopefully) lead to a fix.

In fact, thnis is the contrary... Casting is dangerous because it rely on the programmer instead of the compiler.

Thus take the habit to never add a cast if it not strictly necessary and if it is necessary, then first check if it is possible to avoid the cast by correcting the code like changing a badly selected variable type for something more appropriate.