mapbox-store-locator-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs official software packages and assets from Mapbox and the Turf.js project.
- Recommends installation of
mapbox-gland@turf/turfthrough standard package registries. - Fetches stylesheet and script assets from Mapbox's official CDN.
- [INDIRECT_PROMPT_INJECTION]: The skill patterns demonstrate rendering properties from GeoJSON data sources directly into the application's UI using
innerHTMLandsetHTMLwithout escaping. - Ingestion points: External GeoJSON data is processed in
SKILL.md,references/geolocation-directions.md, andreferences/variations-react.mdto display location names, addresses, and other details. - Boundary markers: None identified. The code does not implement delimiters or explicit instructions to ignore potentially malicious content within the data fields.
- Capability inventory: The skill includes network access to Mapbox APIs and the ability to modify the application's DOM and map popups.
- Sanitization: Absent. Data properties are interpolated directly into HTML strings, providing a vector for injection if the input data contains adversarial instructions or script content.
Audit Metadata