leaflet
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides examples that load the Leaflet library and CSS from unpkg.com, a widely recognized CDN for NPM packages. The provided HTML snippets include Subresource Integrity (SRI) hashes to ensure the integrity of the downloaded code.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of potentially untrusted geospatial data and metadata.\n
- Ingestion points: Data enters through the
storesandzonesproperties in the React components defined inSKILL.md.\n - Boundary markers: No specific boundary markers are utilized to separate data from instructions.\n
- Capability inventory: The skill is restricted to client-side rendering and does not possess capabilities for file system modification or unauthorized network requests.\n
- Sanitization: The documentation explicitly highlights the risk of HTML injection in map popups and recommends appropriate sanitization techniques and React's built-in protection mechanisms.
Audit Metadata