threejs-gltf-loading
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches DRACO and KTX2 decoder assets from the jsDelivr CDN. These are official, version-pinned components of the Three.js library used for decompressing 3D geometry and textures.
- [COMMAND_EXECUTION]: Recommends executing the
gltf-transform validatecommand to check the integrity of 3D models. This is an established development workflow for asset verification and does not involve execution of untrusted or arbitrary commands. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of glTF and GLB files. This creates a data ingestion surface; however, the risk is minimized as the data is consumed by the Three.js rendering engine for visualization and animation, rather than being parsed for instructions that could influence the agent's logic or high-privilege capabilities.
Audit Metadata