threejs-assets
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads 3D assets, textures, and HDRIs from
api.polyhaven.comandapi.sketchfab.com. These are well-known, legitimate services for 3D content creators. - [COMMAND_EXECUTION]: The skill uses
nodeto execute its fetching script (fetch.mjs). This is standard behavior for a Node.js-based utility. - [CREDENTIALS_SAFE]: The script uses an environment variable
SKETCHFAB_TOKENfor authenticated downloads from Sketchfab. It does not hardcode secrets and follows safe practices for secret management by instructing the user to set the environment variable. - [DATA_EXFILTRATION]: Network operations are scoped to asset searching and downloading from the identified APIs. There is no evidence of sensitive local file access or unauthorized data transmission.
Audit Metadata