threejs-model-fix
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's primary function is to provide technical guidance and code snippets for 3D model repair, which is handled through standard libraries and documented processes.
- [EXTERNAL_DOWNLOADS]: The skill mentions external resources for 3D decoders and environment presets, specifically targeting well-known services like Google's gstatic CDN and githack for GitHub-hosted assets. These are standard in the three.js development ecosystem.
- [COMMAND_EXECUTION]: The instructions involve executing local scripts for model inspection (node inspect.mjs) and using common command-line utilities such as npx @gltf-transform/cli. These are legitimate tools for the stated purpose of model optimization and fixing.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external 3D model files which constitutes an attack surface for indirect injection.
- Ingestion points: 3D model files (.glb, .gltf) are loaded via three.js and inspected using local scripts.
- Boundary markers: No explicit instructions to ignore embedded metadata are provided, though the probability of an LLM obeying instructions within a binary 3D model is low.
- Capability inventory: The skill has the ability to execute shell commands (node, npx) and read/write files.
- Sanitization: The skill relies on the parsing logic of standard three.js loaders and the gltf-transform utility.
Audit Metadata