The Agent Skills Directory

[DYNAMIC_EXECUTION]: The Agent Toolkit includes tools like analyseData and processData that execute model-generated JavaScript.
By default, this code runs in a sandboxed Web Worker inside an opaque-origin iframe with restrictive CSP settings to prevent access to the DOM, network, or storage.
An optional, opt-in tool executeMaplibreCode allows for un-sandboxed execution in the host page context, which is explicitly documented as requiring high trust in the model.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data through the 'Bring Your Own Data' (BYOD) feature and incident feeds.
Ingestion Point: addByodSource and trafficAreaAnalytics tools in agent-toolkit/byod.md and traffic.md.
Boundary Markers: The documentation specifies using a 'safe profile' for model-facing results, which involves withholding string values from the model to mitigate prompt injection vectors while still allowing numeric/boolean analysis.
Capability Inventory: The skill has broad capabilities including file read, network fetch (for BYOD), and dynamic execution, but these are constrained by the toolkit's architecture.
[COMMAND_EXECUTION]: The instructions in SKILL.md guide the agent to offer automated installation of a feedback skill using the npx skills add command.
Evidence: npx skills add tomtom-international/maps-sdk-js --skill tomtom-maps-sdk-js-feedback -y.
This command is targeted at vendor-owned resources (tomtom-international) and is part of the intended developer experience for reporting issues to the SDK team.
[EXTERNAL_DOWNLOADS]: The skill documentation references downloading assets such as font files and KTX2 transcoders.
These downloads target well-known services (e.g., cdn.jsdelivr.net) or the application's own origin, consistent with standard web development practices for a maps SDK.

tomtom-maps-sdk-js