react-three-fiber-drei
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No prompt injection patterns or attempts to override agent behavior were detected in the instructions or metadata.
- [DATA_EXFILTRATION]: No sensitive file paths, credential markers, or suspicious network operations to non-whitelisted domains were found. Asset loading uses local relative paths (e.g.,
/models/product.glb). - [REMOTE_CODE_EXECUTION]: The skill uses standard package installations for established libraries (
three,@react-three/fiber,@react-three/drei) from standard registries. There is no execution of remote scripts via curl/bash or similar patterns. - [OBFUSCATION]: No obfuscated content, encoded strings, zero-width characters, or homoglyphs were identified in the skill files.
- [PRIVILEGE_ESCALATION]: No commands for acquiring elevated privileges (e.g., sudo, chmod 777, registry modifications) are present.
- [PERSISTENCE]: No persistence mechanisms such as shell profile modifications, cron jobs, or startup task creation were detected.
- [INDIRECT_PROMPT_INJECTION]: While the skill provides tools to ingest 3D assets (
useGLTF), this is a standard functional requirement for 3D development and does not represent an elevated security risk in this context. - [DYNAMIC_CONTEXT_INJECTION]: No use of the
!commandsyntax or shell execution at skill load time was found.
Audit Metadata