three-text-troika-3d
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected across all 11 threat categories.
- [DYNAMIC_EXECUTION]: The skill utilizes
createDerivedMaterialto inject GLSL code into Three.js shaders. This is a standard and safe practice for customizing 3D materials in graphics programming and does not involve executing arbitrary system commands or processing untrusted external script data. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential attack surface for indirect prompt injection as it ingests external text strings and font files for rendering. However, these inputs are used solely for visual rendering within a WebGL context and the skill lacks exploitable capabilities such as network exfiltration or sensitive file writing, posing no significant risk.
- [EXTERNAL_DOWNLOADS]: The skill references standard font file types (.ttf, .otf, .woff) through relative paths or placeholder URLs (e.g.,
/fonts/Inter-Bold.woff), which is standard behavior for web-based 3D applications.
Audit Metadata