threejs-animation
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a technical guide for Three.js animation features like AnimationMixer and morph targets. The provided JavaScript examples are standard for web development and do not perform unauthorized file access, network exfiltration, or command execution.
- [EXTERNAL_DOWNLOADS]: The skill references official Three.js documentation and a GitHub repository for source context. These resources are well-known or directly related to the skill's purpose and do not represent a remote code execution risk.
- [PROMPT_INJECTION]: The skill instructs the agent on how to process external 3D model data (GLTF animations). While this is a surface for indirect prompt injection, the impact is mitigated as the data is used exclusively within the Three.js engine's animation APIs.
- Ingestion points: Reads animation names and object hierarchies from
gltf.animationsandgltf.scenein SKILL.md. - Boundary markers: None mentioned for the ingested model data.
- Capability inventory: Limited to Three.js internal methods (
AnimationMixer,clipAction). No capability to perform shell commands, network requests, or file writes using the ingested data. - Sanitization: Data is used to look up animation clips and set bone/morph influences; no sanitization is required for these specific API calls.
Audit Metadata