The Agent Skills Directory

[SAFE]: The skill facilitates the management of CARTO Builder maps using official vendor tools (carto CLI and MCP). All external domains mentioned, such as cartodb.com and cartodb.io, are legitimate vendor resources.
[SAFE]: The skill implements a secure approach to SQL filtering via SQL parameters. By using {{placeholder}} syntax and translating it into provider-native named (@param) or positional ($1) parameters, it effectively prevents SQL injection attacks.
[SAFE]: For custom HTML popups, the documentation explicitly states that the renderer sanitizes the content, stripping out potentially dangerous elements such as <script> tags, iframe elements, and event-handler attributes (e.g., onclick).
[SAFE]: The instructions for visual verification include the use of playwright, a well-known service from Microsoft, for rendering screenshots. This is a standard and safe development workflow.
[SAFE]: The 'Agent on the map' configuration includes security controls such as organization-level enablement checks and capability-driven tool activation (e.g., querySources is disabled by default). This limits the exposure of sensitive data processing capabilities.
[SAFE]: Ingestion of data from external warehouses (Category 8 surface) is handled via secure SQL-based tools and specialized renderers that sanitize output, mitigating risks associated with untrusted data ingestion.

carto-create-builder-maps