maptiler-sdk-js
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches JavaScript and CSS from cdn.maptiler.com and recommends installing packages from the @maptiler organization. These are verified vendor resources and well-known mapping services.\n- [COMMAND_EXECUTION]: Provides a shell script (scripts/install-deps.sh) for installing official @maptiler dependencies. The script is restricted to specific, legitimate packages from the vendor.\n- [PROMPT_INJECTION]: The skill uses
setHTML()in several examples (SKILL.md, scripts/geocoding-search.html) to render content in popups. This creates a surface for indirect prompt injection if the GeoJSON data or search results originate from an untrusted source.\n - Ingestion points: GeoJSON data passed to
addPoint,addPolyline, andaddPolygonhelpers in SKILL.md and references/helpers-api.md.\n - Boundary markers: None identified in the provided patterns for delimiting untrusted geographic data.\n
- Capability inventory: The SDK can render markers, popups, and interactive map layers in the browser.\n
- Sanitization: Examples use standard
setHTML()calls which do not include sanitization logic for user-provided or external data.
Audit Metadata