arcgis-widgets-advanced
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official ArcGIS NPM packages and references standard ArcGIS service domains for map tiles and oriented imagery. It explicitly documents security requirements for sensitive features, such as the need for HTTPS and user permission for GPS tracking.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes data from map layers and user-driven inputs via the HistogramRangeSlider widget.
- Boundary markers: No explicit delimitation or instruction-ignoring warnings are present in the code snippets.
- Capability inventory: The skill facilitates network operations for map data visualization and imagery retrieval.
- Sanitization: Examples use template literal interpolation for definitionExpression filters; while this is standard usage for the ArcGIS API, it represents a potential injection surface if variables like field names or values were derived from untrusted external data.
Audit Metadata