bmap-jsapi-gl
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for loading the official Baidu Maps JSAPI WebGL library from api.map.baidu.com. Evidence: references/map-init.md contains a script reference to //api.map.baidu.com/api?v=1.0&type=webgl&ak=...
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes how to process results from various Baidu Maps LBS services (such as geocoding, local search, and routing) and provides examples for rendering this data using methods like innerHTML and setContent. This identifies a vulnerability surface where malicious content returned from an external API could influence the application or agent. Ingestion points: references/local-search.md, references/geocoder.md, references/route-common.md, and references/custom-overlay.md. Capability inventory: SDK methods for DOM creation and dynamic information window content. Boundary markers: Not present in documented examples. Sanitization: Examples show direct interpolation of dynamic properties into HTML strings without explicit sanitization or escaping instructions.
Audit Metadata