threejs-webgl

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the Three.js library and its official addons from the well-known jsDelivr CDN.
  • Evidence: Found in assets/starter_scene/index.html within the importmap pointing to https://cdn.jsdelivr.net/npm/three@0.185.1/.
  • [DYNAMIC_EXECUTION]: The skill includes a Python utility script (scripts/setup_scene.py) designed to generate JavaScript scene boilerplate based on developer input.
  • Evidence: The script uses string formatting and argparse to output Three.js scene configurations to stdout or local files.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents methods for loading and rendering external 3D models (glTF), which is a standard surface for processing complex external data.
  • Ingestion points: gltfLoader.load() methods documented in SKILL.md and implemented in assets/starter_scene/main.js.
  • Boundary markers: None specified in the instructions for identifying or ignoring malicious sub-components within binary model files.
  • Capability inventory: The skill enables 3D rendering, scene graph manipulation, and animation playback.
  • Sanitization: No specific validation or sanitization is implemented for model metadata or nested scene properties.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 06:45 PM