3d-web-experience

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill contains instructions for the agent to install global Node.js packages and execute shell commands for 3D asset optimization.
  • Evidence: npm install -g @gltf-transform/cli and gltf-transform optimize input.glb output.glb in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill references external domains for fetching 3D assets and identifies its origin from a community repository.
  • Evidence: References to prod.spline.design for scene assets and github.com/sickn33/antigravity-awesome-skills for repository provenance in SKILL.md and ORIGIN.md.
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it facilitates the processing of external data files (3D models).
  • Ingestion points: useGLTF('/model.glb') pattern in SKILL.md where external model files are loaded into the scene.
  • Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore embedded metadata or instructions within the 3D files.
  • Capability inventory: The skill utilizes shell commands (npm, gltf-transform) and network-based asset loading.
  • Sanitization: Absent; the skill does not specify validation steps for the content of loaded 3D assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 09:22 PM
Security Audit — agent-trust-hub — 3d-web-experience