threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and examples for Three.js loaders, promoting standard development practices.
- [EXTERNAL_DOWNLOADS]: The skill fetches 3D decoders and transcoders from well-known services, including Google's gstatic domain and the JSDelivr CDN. These are established sources for web assets and are used here for their intended purpose of processing Draco and KTX2 compressed models.
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external 3D assets.
- Ingestion points: The
SKILL.mdfile usesloader.load()andfetch()to ingest external models and textures. - Boundary markers: None are explicitly defined in the code snippets for validating the source URLs.
- Capability inventory: The skill's functionality is limited to Three.js scene manipulation (adding objects, modifying materials) and does not include risky operations such as shell execution or file system writes.
- Sanitization: No explicit sanitization of asset metadata is performed.
Audit Metadata