threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation, references, and workflows for using three.js loading and exporting utilities. It correctly identifies the scope of asset I/O and points to official documentation at threejs.org, which is a well-known and trusted domain.
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions to process user-provided asset URLs.
- Ingestion points: User-supplied URLs for 3D models and textures are mentioned in SKILL.md.
- Boundary markers: The instructions do not define specific prompt delimiters but recommend that the agent mention validation.
- Capability inventory: The loaders (GLTFLoader, TextureLoader) use network requests to fetch external data and parse binary/JSON formats.
- Sanitization: The skill explicitly recommends security best practices, stating 'only load user URLs with validation' and advising on CORS for cross-origin assets.
Audit Metadata