three-physics-rapier

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill integrates @dimforge/rapier3d-compat, a well-known physics library for the web. It uses the compatibility build which includes the WASM binary as a Base64 string to avoid complex external loading mechanisms and ensure consistent behavior.
  • [REMOTE_CODE_EXECUTION]: All simulation logic is contained within the audited script files. There is no evidence of remote script fetching or dynamic execution of untrusted code. The skill relies on local library initialization via RAPIER.init().
  • [DATA_EXFILTRATION]: The physics system operates entirely within the local Three.js scene context. No network operations or data transmission patterns to external domains were detected.
  • [PERSISTENCE]: The skill implements a comprehensive dispose() method that explicitly frees WASM memory using world.free() and cleans up all physics objects, preventing memory leaks and persistent background processes after the component is unmounted.
  • [COMMAND_EXECUTION]: There are no shell commands or subprocess calls. All interactions are restricted to the JavaScript/WASM bridge provided by the physics engine.
  • [DYNAMIC_EXECUTION]: The skill uses static factory methods from the Rapier library to create colliders and rigid bodies. It does not generate or execute dynamic code strings based on user input.
  • [INDIRECT_PROMPT_INJECTION]: While the skill processes geometry data from the scene to create physics colliders, it treats this data as numerical vertex/index arrays only, leaving no surface for natural language instruction injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 05:48 PM
Security Audit — agent-trust-hub — three-physics-rapier