tmap-jsapi-gl
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill loads several external JavaScript libraries and resources necessary for map rendering and data visualization.
- Scripts are loaded from
map.qq.com,mapapi.qq.com, andlbs.gtimg.com, which are domains associated with the author (TencentLBS). - Example:
https://map.qq.com/api/gljs?v=1.exp&key=OB4BZ-D4W3U-B7VVO-4PJWW-6TKDJ-WPB77found in multiple demo files. - It also references an external test server for WMS layers at
ahocevar.com(associated with the well-known OpenLayers project). - [CREDENTIALS_UNSAFE]: Multiple demo files include a hardcoded API key used to authenticate requests to the Tencent Maps service.
- Evidence:
key=OB4BZ-D4W3U-B7VVO-4PJWW-6TKDJ-WPB77found inreferences/visualization/demos/2D经典热力.htmland other demo files. - Context: This is identified as a public demo key provided by the vendor for trial and demonstration purposes in their official documentation.
- [REMOTE_CODE_EXECUTION]: The skill utilizes JSONP (JSON with Padding) to fetch data from the Tencent Maps WebService API, which involves dynamic script creation.
- Files like
references/jsapigl/demos/折线_折线应用:路线规划.htmluse ajsonp_requestfunction to dynamically create and append script tags to the document. - This pattern is used exclusively to load geospatial data (such as route coordinates) from the vendor's official API domain (
apis.map.qq.com).
Audit Metadata