threejs-builder
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides boilerplate code that fetches the Three.js library and various addons (OrbitControls, GLTFLoader, EffectComposer, etc.) from the Unpkg CDN (e.g.,
https://unpkg.com/three@0.160.0/build/three.module.js). It also references Google's GStatic CDN for the Draco mesh decoder (https://www.gstatic.com/draco/v1/decoders/). These are well-known services used for standard web development. - [INDIRECT_PROMPT_INJECTION]: The skill includes instructions and code patterns for loading external 3D model files (GLTF/GLB) via the
GLTFLoader. This represents an ingestion point for external data into the application context. - Ingestion points: External model files loaded via
loader.load()inreferences/gltf-loading-guide.mdandreferences/advanced-topics.md. - Boundary markers: None; the skill assumes the models are valid assets.
- Capability inventory: The skill documentation is focused on rendering graphics in a browser environment and does not include capabilities for sensitive file access, arbitrary command execution, or non-whitelisted network exfiltration.
- Sanitization: Standard Three.js loaders handle the parsing of the binary/JSON GLTF format.
Audit Metadata