data-globe
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/bootstrap.pyutility downloads the MapLibre GL JS library (v5.24.0) from the well-known unpkg.com CDN during the initial setup process. - Evidence: Calls
urllib.request.urlretrievefor the library's JS, CSS, and license files. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external location data (CSV/JSON), which represents a potential surface for indirect prompt injection if malicious instructions are embedded in the dataset.
- Ingestion points: The
scripts/prepare.pyscript reads user-provided datasets from the file system. - Boundary markers: Data processing is constrained by a required field mapping and validation logic in the preparation script.
- Capability inventory: The skill can generate local files, process images via the Pillow library, and serve the resulting visualization through a local HTTP server.
- Sanitization:
template/app.jsimplements asafeURLfunction that filters external links to allow only standard web protocols, andscripts/prepare.pyperforms type checking and range validation on coordinate and weight fields.
Audit Metadata