3d-visualizer
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill metadata contains an installation command that fetches the skill instructions from its official GitHub repository (raw.githubusercontent.com/majiayu000/claude-skill-registry). This is standard behavior for skill distribution and uses a well-known service.
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for 3D charts and network graphs that process user-supplied data (labels, node IDs, values).
- Ingestion points: The
dataprop in the BarChart3D component and thenodes/edgesprops in the NetworkGraph component. - Boundary markers: The sample code does not include specific boundary markers or 'ignore' instructions for the data being visualized.
- Capability inventory: The skill focuses on rendering 3D graphics in a web context and does not include capabilities for file system modification, network exfiltration, or command execution within its visualization logic.
- Sanitization: Standard React rendering is used, which provides inherent protection against basic script injection, though no custom natural language sanitization is present in the templates.
- [SAFE]: The skill utilizes well-known, industry-standard libraries including Three.js, @react-three/fiber, and @react-three/drei. The code examples provided are functional, idiomatic, and contain no signs of obfuscation, credential harvesting, or unauthorized persistence.
Audit Metadata