create-ixmap
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the AI agent to generate HTML documents that include JavaScript libraries from trusted sources, including the official D3.js domain and the developer's verified GitHub repository (gjrichter/ixmaps-flat) via the jsDelivr CDN. It also references geographic data sources from established organizations such as Eurostat (GISCO).
- [DATA_EXFILTRATION]: Includes a utility script (
upload-helper.sh) and a detailed hosting guide for uploading user-generated map data to a dedicated GitHub repository. While this facilitates network communication and data transfer, it is a documented core feature for map hosting, relies on user-provided environment variables for authentication, and encourages the use of fine-grained, scoped access tokens. - [PROMPT_INJECTION]: The skill processes external data files (CSV, JSON, GeoJSON) provided by the user, which constitutes an indirect prompt injection surface. However, the instructions provide clear guidance for the model to validate data structures and geographic coordinates, and the functionality is limited to client-side visualization in the resulting HTML file.
- [SAFE]: The skill includes positive security constraints, explicitly directing the model to avoid outdated or potentially untrusted domains and to strictly use the developer's official repository for framework resources.
Audit Metadata