mapbox-maplibre-migration
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install standard Node.js packages such as
mapbox-gl,@mapbox/mapbox-gl-geocoder, and@mapbox/mapbox-gl-draw. These are official packages from the vendor and are used as intended for the migration. - [DATA_EXPOSURE_&_EXFILTRATION]: The guide includes code snippets that demonstrate how to use Mapbox API tokens. It explicitly includes a security warning against hardcoding tokens in source code and recommends using environment variables and URL restrictions, which is a best-practice security measure.
- [COMMAND_EXECUTION]: The skill mentions standard shell commands for package management (
npm install,npm uninstall). These are static instructions for the developer and are not executed dynamically by the agent in a risky manner. - [INDIRECT_PROMPT_INJECTION]: The skill provides informational guidance and code templates. It does not ingest untrusted external data at runtime that could be used for injection attacks, nor does it have capabilities to execute arbitrary code or perform unauthorized network operations.
Audit Metadata