The Agent Skills Directory

[SAFE]: The skill documents legitimate Mapbox GL JS integration patterns for interactive maps. It follows security best practices by recommending the use of environment variables for sensitive access tokens instead of hardcoding them within the skill or application code.
[DATA_EXFILTRATION]: No unauthorized network operations or sensitive data access patterns were found. The skill utilizes standard Mapbox services and official, well-known plugins for geocoding and directions.
[PROMPT_INJECTION]: The skill proactively addresses the risk of indirect injection (specifically XSS) through untrusted data in map popups. It provides explicit mitigation guidance, instructing the agent to use setText() or setDOMContent() for user-provided data to prevent cross-site scripting, rather than the unsafe setHTML() method.

web-maps-mapbox