The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references basemap styles from Carto's content delivery network (tiles.basemaps.cartocdn.com) and documentation from MapLibre. These are established services in the web mapping ecosystem and are used here for their intended purpose of providing map assets.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the dynamic construction of tile request URLs and JS source configurations using external inputs like table names and filter strings. This creates a potential surface for injection if the inputs are not properly sanitized before being used in requests to the backend tileserver.
Ingestion points: Project API URLs, anon keys, schema/table names, and CQL filter strings (SKILL.md).
Boundary markers: The skill explicitly mentions using encodeURIComponent to wrap filter values, which serves as a boundary marker for parameters in the constructed URL.
Capability inventory: The skill instructs the agent to help set up network requests for fetching vector tile data (.pbf files) from a remote server.
Sanitization: Recommends the use of encodeURIComponent in application code to sanitize filter strings before interpolation into the tile URL template.

geobase-tileserver