The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The skill implements dynamic script loading mechanisms that fetch and execute JavaScript from external sources at runtime. This bypasses static security controls and allows for potential code injection if the external source is compromised.
Evidence: references/leaflet-arcgis-equivalents/integration-guide.md contains a loadScript function and a list of CDN URLs (unpkg.com) loaded sequentially. references/leaflet-arcgis-equivalents/05-heatmaps-density.md also dynamically appends a script tag for leaflet-heat.js.
COMMAND_EXECUTION (HIGH): The PHP code examples for spatial database queries are vulnerable to SQL Injection. Variables are interpolated directly into raw SQL strings instead of using prepared statements.
Evidence: In references/leaflet-arcgis-equivalents/02-spatial-queries.md, the findInBuffer method interpolates $lng, $lat, and $bufferMeters directly into the $bufferWKT string used in a whereRaw call.
COMMAND_EXECUTION (HIGH): The skill provides patterns for generating JavaScript from PHP that are vulnerable to Cross-Site Scripting (XSS). User-controlled or configuration variables are placed directly into script blocks.
Evidence: references/leaflet-arcgis-equivalents/01-basic-mapping.md uses a heredoc in getMapScript to generate JS, interpolating {$elementId} and configuration values directly into the script.
DATA_EXFILTRATION (MEDIUM): The skill makes external requests to various third-party GIS providers (Nominatim, Photon, OSRM, ArcGIS) with location data. While expected for GIS functionality, there is no evidence of data sanitization or proxying to protect user privacy.
Evidence: 03-geocoding.md and 06-routing-network-analysis.md demonstrate direct curl and fetch calls to external domains.
CREDENTIALS_UNSAFE (LOW): The skill references the use of API keys (e.g., osm_api_key) and demonstrates a pattern of exposing these keys to the client-side via the window object.
Evidence: SKILL.md and geofencing.md show patterns for injecting window.osmApiKey from system settings.

gis-mapping