leaflet
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions reference fetching map tiles from OpenStreetMap, a standard and well-known open-source geospatial service.
- [COMMAND_EXECUTION]: Provides instructions to install standard mapping libraries including
leafletandreact-leafletusingnpm install. - [INDIRECT_PROMPT_INJECTION]: The skill defines components that render map markers and popups from external data sources, which represents a common vulnerability surface.
- Ingestion points: The
storesandzonesdata structures processed in the React components inSKILL.md. - Boundary markers: No explicit delimiters or instructions are used to distinguish map data from potential prompt content in popups.
- Capability inventory: Generates UI code and performs package management via
npm. - Sanitization: Data properties are interpolated directly into popup template strings without visible sanitization in the provided snippets.
Audit Metadata