threejs-aaa-graphics-builder
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides instructions for dynamically assembling and injecting GLSL code into Three.js materials using the
onBeforeCompilepattern inreferences/shader-cookbook.md. This involves runtime string manipulation to create executable shader programs. - [COMMAND_EXECUTION]: The instructions require the agent to execute specific shell scripts and npm commands for project diagnostics, such as
threejs-game-director/scripts/probe_asset_credentials.shandnpm run inspect:canvas. These tools appear to be vendor-provided (899ms) utilities for managing external asset generation. - [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting external visual and performance data (screenshots and renderer metrics) which could potentially contain malicious instructions meant to influence the agent's code generation.
- Ingestion points:
SKILL.mdandreferences/visual-scorecard.md(screenshots, renderer metrics) - Boundary markers: Not specified for visual or metric data
- Capability inventory:
SKILL.md(file writing for 3D models and shaders, execution of local scripts) - Sanitization: Not explicitly addressed in the provided instructions
Audit Metadata