threejs-webgl
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Three.js library and its official addons from the well-known jsDelivr CDN.
- Evidence: Found in
assets/starter_scene/index.htmlwithin theimportmappointing tohttps://cdn.jsdelivr.net/npm/three@0.185.1/. - [DYNAMIC_EXECUTION]: The skill includes a Python utility script (
scripts/setup_scene.py) designed to generate JavaScript scene boilerplate based on developer input. - Evidence: The script uses string formatting and
argparseto output Three.js scene configurations to stdout or local files. - [INDIRECT_PROMPT_INJECTION]: The skill documents methods for loading and rendering external 3D models (glTF), which is a standard surface for processing complex external data.
- Ingestion points:
gltfLoader.load()methods documented inSKILL.mdand implemented inassets/starter_scene/main.js. - Boundary markers: None specified in the instructions for identifying or ignoring malicious sub-components within binary model files.
- Capability inventory: The skill enables 3D rendering, scene graph manipulation, and animation playback.
- Sanitization: No specific validation or sanitization is implemented for model metadata or nested scene properties.
Audit Metadata