map-generator

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the Leaflet mapping library and geographic tile layers from well-known services. The assets/template-iframe-main.html template loads Leaflet from unpkg.com with Subresource Integrity (SRI) hashes. Additionally, the skill references tile layers from OpenStreetMap, Esri, and OpenTopoMap for various map views.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for potential injection by interpolating user-provided data into generated HTML and JavaScript files. 1. Ingestion points: User-supplied information such as marker titles, descriptions, and map purposes are gathered and used to fill placeholders in the provided templates. 2. Boundary markers: The skill does not specify the use of delimiters to separate user-provided text from the generated code or documentation structure. 3. Capability inventory: The agent performs file-write operations to create the project directory and its components (main.html, script.js, style.css, etc.). 4. Sanitization: The instructions do not explicitly mandate that the agent sanitize or escape user-provided strings before they are embedded into the generated assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:32 PM