threejs-game-director
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill architecture is designed for project management and coordination of specialized Three.js tools without introducing malicious behaviors.\n- [COMMAND_EXECUTION]: Local Python and Node.js scripts are used for project verification and asset checking. These scripts are scoped to the project directory and perform non-destructive, documented tasks.\n- [INDIRECT_PROMPT_INJECTION]: The evidence checking tool parses project manifests and reports. It utilizes robust path resolution and strictly limits activity to file metadata verification, avoiding the execution of untrusted file content.\n- [DATA_EXFILTRATION]: The
scripts/probe_asset_credentials.shscript sources user shell profiles to verify the presence of API keys. This is a functional requirement for checking tool availability and is mitigated by the script's design, which only reports status without exposing or transmitting the values.
Audit Metadata