nixie-fx-runtime
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to install the
nixie-fxpackage and its peer dependencies (threeorpixi.js) using npm. This is a standard installation step for the library's functionality. - [EXTERNAL_DOWNLOADS]: The implementation fetches manifest and effect configuration files from a user-specified
baseUrl. This is a routine operation for loading game assets and does not involve suspicious or hardcoded remote sources. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external JSON data from remote URLs.
- Ingestion points: Manifest and effect JSON files are fetched in
references/export-bundles.md. - Boundary markers: The skill uses structured schema parsing via the
parseVfxExportManifestfunction to validate the structure of the fetched data. - Capability inventory: The skill's capabilities are limited to network fetching and renderer interaction; it does not have access to sensitive system resources or command execution beyond the initial installation.
- Sanitization: External content is treated as structured data and processed by library-specific loaders rather than being directly interpolated into agent prompts.
Audit Metadata