threejs-dev-setup
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and provides standard boilerplate for three.js projects. It references official documentation at threejs.org and standard packages on npmjs.com.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements regarding project scaffolding (e.g., choice of bundler, three.js version). While this represents an ingestion point for untrusted data, the skill does not possess high-risk capabilities such as arbitrary file writes, network exfiltration, or command execution that could be exploited via injection. The instructions generate standard, non-executable markdown and code templates.
- [EXTERNAL_DOWNLOADS]: The skill references resources from threejs.org and npmjs.com. These are well-known and established services for the three.js ecosystem, and their inclusion for documentation and package management purposes is consistent with the skill's stated goal.
Audit Metadata