threejs
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical manual for Three.js developers. It includes comprehensive documentation on core library features, the new WebGPU/TSL shading language, and migration guides for recent releases.
- [EXTERNAL_DOWNLOADS]: The documentation references official Three.js files and addons hosted on the JSDelivr CDN (cdn.jsdelivr.net). This is a standard and expected practice for web development documentation and does not pose a security risk.
- [DYNAMIC_EXECUTION]: The skill describes the Three Shading Language (TSL), which allows for the dynamic generation and compilation of GPU shaders at runtime. This is an intended core functionality of Three.js for supporting WebGPU and does not represent a malicious execution vector.
- [INDIRECT_PROMPT_INJECTION]: As a graphics utility, the skill facilitates the loading of external 3D assets (e.g., glTF, textures). While this represents a data ingestion surface common to all graphics applications, no specific vulnerabilities or malicious redirection patterns were identified.
Audit Metadata