Claude Code, Skill
Maplibre Agent Skills
Curated guidance for AI assistants building MapLibre applications — covering ecosystem and open-source best practices.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 24
postinstall
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
runs a script at install time. The docs document an installer that pipes a download into a shell.
INSTALL_LIFECYCLE_HOOK INSTALL_DOCUMENTED_INSTALLER
package.json, line 24
postinstall
evals/results/latest/maplibre-fonts-glyphs-baseline-tests-3-4-5_2026-10-26.csv, line 1178
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
evals/results/latest/maplibre-fonts-glyphs-baseline-tests-3-4-5_2026-10-26.csv, line 1354
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
Network
Concern
can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. can reach api.groq.com. The description does not name that host. can reach api.mapbox.com. The description does not name that host. can reach photon.komoot.io. The description does not name that host. can reach nominatim.openstreetmap.org. The description does not name that host. can reach api.geocode.e. The description does not name that host. can reach username.github.io.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST NETWORK_NAMED_HOST
scripts/merged-pr.js, line 44
const res = await fetch(
scripts/release-watch.js, line 82
const res = await fetch(`https://api.github.com${path}`, {
scripts/run-evals.js, line 398
return await fetch(GROQ_CHAT, {
Show more
scripts/run-evals.js, line 519
const response = await fetch(`${GEMINI}/${model}:generateContent`, {
skills/maplibre-pmtiles-patterns/SKILL.md, line 101
fetch(params.url)
skills/maplibre-pmtiles-patterns/SKILL.md, line 110
const response = await fetch(params.url, { signal: abortController.signal });
skills/maplibre-running-evals/SKILL.md, line 24
curl -s -X POST https://api.groq.com/openai/v1/chat/completions \
evals/results/2026-09-06-maplibre-mapbox-migration.csv, line 850
fetch(url)
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
scripts/release-watch.js, line 71
const fromEnv = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
scripts/run-evals.js, line 324
...env,
scripts/run-evals.js, line 1014
...env,
Show more
scripts/run-evals.js, line 1488
: await measureLimits({ pin, apiKey: process.env.GROQ_API_KEY });
scripts/run-evals.js, line 1499
process.env.EVAL_TOKENS_PER_DAY || TOKENS_PER_DAY_DEFAULT
scripts/run-evals.js, line 1540
? await daySpent({ pin, apiKey: process.env.GROQ_API_KEY })
evals/results/latest/maplibre-v6-migration-setworkerurl-baseline_2026-08-25.csv, line 129
| `import.meta.env.VITE_MAP_STYLE` | Vite’s way to read environment variables at **build time**. You can set it in a `.env` file (see below). |
evals/results/latest/maplibre-v6-migration-setworkerurl-baseline_2026-08-25.csv, line 138
Create a file called **`.env`** in the project root:
evals/results/latest/maplibre-v6-migration-setworkerurl-baseline_2026-08-25.csv, line 141
# .env
evals/results/latest/maplibre-v6-migration-setworkerurl-baseline_2026-08-25.csv, line 150
You can also create `.env.production` and `.env.development` to have different styles per environment.
evals/results/latest/maplibre-v6-migration-setworkerurl-baseline_2026-08-25.csv, line 215
**`.env`**
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
package-lock.json, line 1
{
Licence
Pass
A licence file is present (LICENSE.md).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6acfea707c8d. runs a script at install time. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. can reach api.groq.com. The description does not name that host. can reach api.mapbox.com. The description does not name that host. can reach photon.komoot.io. The description does not name that host. can reach nominatim.openstreetmap.org. The description does not name that host. can reach api.geocode.e. The description does not name that host. can reach username.github.io. reads a credential or environment file. a file wa
Date and source
Date checked:
github.com
Commit graded: 6acfea707c8d6a1f6028656db24dd959c2959563
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.