threejs-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs local static analysis of code files to identify outdated Three.js patterns. It uses a provided Node.js script with zero external dependencies. The filesystem access is restricted to the local project directory and is used for reading source files and applying documented API renames.\n- [COMMAND_EXECUTION]: The skill executes a local script (
scripts/lint.mjs) using Node.js. This execution is the core functionality of the skill and does not involve remote code or untrusted binaries.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided source files, which is a necessary part of a linting tool.\n - Ingestion points: Project source files (JS, TS, GLSL, etc.) and Markdown files are read in
scripts/lint.mjsusingreadFileSync.\n - Boundary markers: The script does not utilize explicit boundary markers for ingested content.\n
- Capability inventory: The script includes a file-writing capability (
writeFileSync) used to apply automated fixes when the--fixflag is provided.\n - Sanitization: No sanitization is performed on file contents before processing, as the script looks for specific API patterns. The risk is minimized by the specificity of the migration rules.
Audit Metadata