create-ixmap

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill utilizes JavaScript function stringification (using .toString()) to define callbacks such as process and query which are then executed at runtime by the ixMaps engine. This architectural pattern involves dynamic code execution for data transformation purposes.\n- [EXTERNAL_DOWNLOADS]: The skill templates and documentation instruct the agent to include external JavaScript libraries, specifically the ixMaps framework and associated utilities, from the jsDelivr CDN and the author's GitHub repositories. It also references the well-known D3.js library.\n- [DATA_EXFILTRATION]: The provided upload-helper.sh script is designed to upload data files to a user-specified GitHub repository. This process involves transmitting the file content along with a user-provided GitHub API token to api.github.com, which is a well-known and trusted service for this intended purpose.\n- [COMMAND_EXECUTION]: The skill includes a utility script, upload-helper.sh, which executes several system commands including curl, base64, and git to facilitate data management and hosting on GitHub.\n- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes external geographic and statistical data (CSV, JSON, GeoJSON) to generate tooltips and map charts. There are no explicit instructions for sanitizing this data before display.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 07:38 PM