react-map-gl
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill provides documentation and reference patterns for the react-map-gl/maplibre library. It does not contain any executable scripts or malicious instructions.
- [NO_CODE]: This skill consists entirely of markdown documentation and example React code snippets designed to guide an agent or developer in building map interfaces. It does not include any standalone logic or tools to be executed by the agent.
- [REMOTE_CODE_EXECUTION]: The documentation specifically warns against using the default
RTLTextPluginbehavior in react-map-gl, which would otherwise load an external JavaScript plugin from a third-party CDN. It correctly recommends disabling this feature or self-hosting the asset to maintain security and privacy. - [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting data from URL parameters (
?map=) and GeoJSON features. While this represents a potential data ingestion surface, the skill explicitly mentions sanitization through TanStack Router'svalidateSearchand standard React state management, which are best practices for handling untrusted data.
Audit Metadata