maptiler-sdk-js

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's helpers and cloud-API examples explicitly accept and fetch external, user-supplied data sources (e.g., GPX/KML/GeoJSON URLs, MapTiler dataset UUIDs, and remote image URLs) — see SKILL.md and references/helpers-api.md and references/cloud-apis.md — which the agent is instructed to read/parse at runtime and that content can drive actions like adding layers, popups, or flying the map camera, so untrusted third‑party content could indirectly inject instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's demo HTML pages include and execute remote JavaScript at runtime from https://cdn.maptiler.com/maptiler-sdk-js/latest/maptiler-sdk.umd.min.js, which is a required runtime dependency that fetches and runs external code.