scroll-map-journey-mapbox
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill incorporates the Mapbox GL JS library and associated CSS from api.mapbox.com. Mapbox is a recognized and widely-used mapping service, and the use of its official CDN for asset delivery is a standard and expected practice.- [INDIRECT_PROMPT_INJECTION]: The skill architecture includes a mechanism to ingest external data files for map rendering, specifically noted in map-journey.js with the reference to a GeoJSON file. This creates a surface for potential indirect influence if the source file were compromised, although the impact is limited to visual rendering.
- Ingestion points: External GeoJSON data source configuration in map-journey.js (e.g., /data/coffee-production.geojson).
- Boundary markers: None identified in the provided code snippets to delimit or sanitize the imported geographic data.
- Capability inventory: The skill uses Mapbox GL JS for rendering, GSAP for scroll-based animation, and Turf.js for spatial calculations. It does not possess high-privilege capabilities such as arbitrary file system access or shell command execution.
- Sanitization: The implementation does not demonstrate explicit validation or sanitization of the geographic data before it is passed to the mapping engine.- [DYNAMIC_EXECUTION]: The generateSteps and createMarkers functions in map-journey.js use the innerHTML property to dynamically construct user interface components from a local configuration object (CHAPTERS). While this is a common technique for client-side templates, it is a known surface for DOM-based injection vulnerabilities if the configuration data were to include unsanitized user-provided strings.
Audit Metadata