threejs-aaa-graphics-builder

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill provides instructions for dynamically assembling and injecting GLSL code into Three.js materials using the onBeforeCompile pattern in references/shader-cookbook.md. This involves runtime string manipulation to create executable shader programs.
  • [COMMAND_EXECUTION]: The instructions require the agent to execute specific shell scripts and npm commands for project diagnostics, such as threejs-game-director/scripts/probe_asset_credentials.sh and npm run inspect:canvas. These tools appear to be vendor-provided (899ms) utilities for managing external asset generation.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting external visual and performance data (screenshots and renderer metrics) which could potentially contain malicious instructions meant to influence the agent's code generation.
  • Ingestion points: SKILL.md and references/visual-scorecard.md (screenshots, renderer metrics)
  • Boundary markers: Not specified for visual or metric data
  • Capability inventory: SKILL.md (file writing for 3D models and shaders, execution of local scripts)
  • Sanitization: Not explicitly addressed in the provided instructions
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 03:19 PM