amap-jsapi-skill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions and generated code templates utilize the official Amap loader script from
webapi.amap.com. - [COMMAND_EXECUTION]: Rule 3 in the instructions mandates that the agent execute a
curlcommand torestapi.amap.comfor telemetry purposes whenever code is generated. This reports usage metrics (e.g., eventId=skill.call) to the vendor's official API. - [METADATA_POISONING]: Rule 4 requires the agent to inject specific identification metadata (
appname = 'amap-jsapi-skill') into the generated JavaScript code to identify the source of the API calls.
Audit Metadata