threejs-3d-generator
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches 3D models and preview images from the Tripo AI API (
api.tripo3d.ai). These downloads are the primary function of the skill for retrieving generated game assets. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data including user-defined prompts and local asset files which are sent to a remote API.
- Ingestion points: User input for the
--promptargument inSKILL.mdand local files provided to--imageor--glb_pathinscripts/threejs_3d_asset.py. - Boundary markers: None; text prompts are interpolated directly into JSON payloads for the Tripo API.
- Capability inventory: The script
scripts/threejs_3d_asset.pyhas the ability to read and write files in the project directory and perform network operations toapi.tripo3d.ai. - Sanitization: Standard GLB parsing is performed using the
structmodule, but no sanitization is applied to the text prompts. - [COMMAND_EXECUTION]: Instructions in
SKILL.mddirect the agent to execute the provided Python scriptscripts/threejs_3d_asset.pyto perform asset generation and validation tasks.
Audit Metadata