threejs
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes how to load external 3D models and textures from external sources, which is a standard surface for processing untrusted data.
- Ingestion points: Demonstrated through the use of GLTF, FBX, OBJ, and SVG loaders in
references/02-loaders.mdandreferences/15-specialized-loaders.md. - Boundary markers: Code snippets focus on functional implementation and do not include specific boundary delimiters for untrusted asset content.
- Capability inventory: Loaded assets are processed by the Three.js rendering engine and animation mixer for display in the browser.
- Sanitization: No custom sanitization logic is shown for model data, relying on standard Three.js loader parsing behavior.
- [DYNAMIC_EXECUTION]: The skill covers the creation and compilation of custom GLSL and WGSL shader programs at runtime, which is core to 3D graphics development.
- Evidence:
references/11-materials-advanced.mdandreferences/13-node-materials.mdprovide examples of defining shader strings and node-based logic that are compiled by the GPU via Three.js during application execution.
Audit Metadata