geospatial-frontend
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references font assets from Google's official font services (fonts.googleapis.com and fonts.gstatic.com). These are well-known and trusted providers for web development assets.
- [INDIRECT_PROMPT_INJECTION]: The skill outlines a data pipeline that ingests external geospatial data via DuckDB-WASM and GeoJSON. While processing external data is an inherent attack surface for data manipulation, the skill defines a legitimate data exploration use case and does not include exploitable administrative or system-level capabilities.
- Ingestion points: Data pipeline described in SKILL.md (DuckDB-WASM Parquet manifest/shards) and MapLibre GeoJSON sources.
- Boundary markers: None explicitly defined in the scaffolding instructions.
- Capability inventory: Descriptions of UI rendering, spatial filtering, and Web Worker compute tasks.
- Sanitization: Not explicitly detailed in the design rules.
Audit Metadata