The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides instructions and examples for features that render raw HTML or custom DOM elements based on properties in the data source. If an AI agent uses this skill to process untrusted data (e.g., a third-party GeoJSON or CSV file), malicious content within that data could execute scripts or manipulate the interface via methods like Popup.setHTML() or custom Marker elements.
Ingestion points: Data loaded through .source() configurations as seen in references/data/geojson.md, references/data/csv.md, and references/data/source-json.md.
Boundary markers: Most examples do not include explicit sanitization or warnings to ignore embedded instructions within data attributes.
Capability inventory: The library facilitates network requests for data fetching and possesses the ability to render arbitrary HTML strings to the UI.
Sanitization: Examples provided in the documentation do not explicitly demonstrate the use of sanitization libraries before passing data to HTML-rendering methods.
[EXTERNAL_DOWNLOADS]: The documentation includes examples that fetch the L7 library from a CDN and retrieve sample map data from official vendor domains such as gw.alipayobjects.com and antv.antgroup.com. These are recognized as legitimate resources associated with the library maintainers.

antv-l7