1{2 "skill_name": "mapbox-token-security",3 "evals": [4 {5 "id": 1,6 "prompt": "Our Mapbox secret token is 85 days old and used by 3 production services. We want to rotate it before the recommended 90-day deadline without any downtime. What is the correct zero-downtime rotation process, and what's the most common mistake teams make that causes an outage during rotation?",7 "expected_output": "Should describe the 7-step zero-downtime process: (1) create new token, (2) deploy to canary/staging, (3) verify with new token, (4) gradually roll out to production, (5) monitor for 24-48 hours, (6) revoke old token only after confirmation, (7) update documentation. The most common mistake is revoking the old token before all services are confirmed working on the new one.",8 "files": [],
10 "Creates the new token BEFORE revoking the old one",
11 "Deploys to canary or staging environment first to verify the new token works",
12 "Specifies a monitoring period (24-48 hours) after rolling out the new token",
13 "Revokes the old token only AFTER confirming the new one is working in production",
14 "Identifies the common mistake: revoking old token before all services are updated"
15 ]
16 },
17 {
18 "id": 2,
19 "prompt": "I'm creating a public Mapbox token for my production web app at https://myapp.com. My developer added allowedUrls: ['*'] to 'keep it simple during development'. Why is this wrong, and what should the allowedUrls look like for production, staging, and local development?",
20 "expected_output": "Should explain that '*' means the token works on any website, making it trivially abusable if leaked. Should provide correct patterns: production ('https://myapp.com/*'), staging ('https://staging.myapp.com/*'), and development ('http://localhost:*'). Should recommend separate tokens per environment.",
21 "files": [],
22 "expectations": [
23 "Explains that allowedUrls: ['*'] means the token works on any website (no restriction)",
24 "Recommends 'https://myapp.com/*' for production",
25 "Recommends 'http://localhost:*' or 'http://127.0.0.1:*' for local development",
26 "Recommends separate tokens per environment (dev, staging, production)",
27 "Warns against overly broad patterns like 'http://*' or '*.com/*'"
28 ]
29 },
30 {
31 "id": 3,
32 "prompt": "I'm building a client-side web app that only needs to display a Mapbox map with custom styles and labels. What is the minimum set of scopes my public token needs? My team lead suggested also adding styles:write and tokens:write 'just in case'. Why is that wrong?",
33 "expected_output": "Should recommend only the scopes needed for map display: styles:read, fonts:read, and styles:tiles. Should explain that styles:write and tokens:write are secret-token-only scopes that should never be on a client-side public token — they could allow an attacker to modify styles or create new tokens if the public token were stolen.",
34 "files": [],
35 "expectations": [
36 "Recommends styles:read as a required scope for map display",
37 "Recommends fonts:read for label/text rendering",
38 "Recommends styles:tiles for raster tile access",
39 "Explains that styles:write and tokens:write should NOT be on a public client-side token",
40 "Explains the principle of least privilege: only grant what the use case actually requires"