maplibre-tile-sources

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs MapLibre to load external TileJSON endpoints, tile URL templates, GeoJSON URLs, glyphs and sprite URLs (e.g., the "url" TileJSON flow and "tiles" array examples), which are public third‑party resources that MapLibre fetches and parses to determine sources, source-layers, and behavior at runtime—so untrusted external content can materially influence agent/tool actions.