threejs-pro
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves loading and processing external 3D model files (GLTF/GLB). While these are standard data formats for web graphics, they constitute an ingestion surface for external data.
- Ingestion points: The
useGLTFhook is used to load external model files inSKILL.md. - Boundary markers: None explicitly defined for model metadata or embedded strings.
- Capability inventory: The skill uses standard CLI tools (
npm,gltf-transform) for package management and asset optimization. - Sanitization: Relies on standard loaders (
@react-three/drei) which perform typical parsing of binary and JSON geometry data.
Audit Metadata