3d-web-experience
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions for the agent to install global Node.js packages and execute shell commands for 3D asset optimization.
- Evidence:
npm install -g @gltf-transform/cliandgltf-transform optimize input.glb output.glbinSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill references external domains for fetching 3D assets and identifies its origin from a community repository.
- Evidence: References to
prod.spline.designfor scene assets andgithub.com/sickn33/antigravity-awesome-skillsfor repository provenance inSKILL.mdandORIGIN.md. - [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it facilitates the processing of external data files (3D models).
- Ingestion points:
useGLTF('/model.glb')pattern inSKILL.mdwhere external model files are loaded into the scene. - Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore embedded metadata or instructions within the 3D files.
- Capability inventory: The skill utilizes shell commands (
npm,gltf-transform) and network-based asset loading. - Sanitization: Absent; the skill does not specify validation steps for the content of loaded 3D assets.
Audit Metadata