shader-dev
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructions and documentation were scanned for patterns typical of prompt injection or behavior override attempts (e.g., 'ignore previous instructions', 'DAN mode'). No such patterns were found. The language used is purely instructional and technical.
- [DATA_EXPOSURE]: There are no instances of hardcoded credentials, API keys, or sensitive system file paths. The code examples are limited to standard GLSL and WebGL2 boilerplate for graphics rendering.
- [REMOTE_CODE_EXECUTION]: The skill does not contain any instructions or scripts that perform external network downloads, package installations, or remote script execution. All functionality is contained within local Markdown files.
- [COMMAND_EXECUTION]: No dangerous shell commands, privilege escalation attempts (like 'sudo'), or persistence mechanisms (like modifying shell profiles) were detected. The skill only provides shader code and basic JavaScript for setting up a WebGL context.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user requests via the
$ARGUMENTSvariable to route the agent to specific documentation files, it lacks any high-privilege tools or capabilities that could be abused. The risk of indirect injection is negligible as the output is restricted to graphics code generation. - [OBFUSCATION]: All provided code and documentation are in plain text. No Base64, hex-encoded instructions, zero-width characters, or homoglyph attacks were found in the analyzed files.
Audit Metadata