cuboid-carousel
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches typography resources from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). These are official domains for a well-known, trusted service.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data via the 'cardsJson' and 'heroCard' variables to populate the carousel visual content.
- Ingestion points: External variables are read through 'window.__hyperframes.getVariables()' in 'cuboid-carousel.html' and parsed at runtime.
- Boundary markers: Data is handled as structured JSON and parsed strictly before being rendered to card textures, preventing instructions from affecting logic.
- Capability inventory: The skill is restricted to Three.js WebGL rendering and Canvas 2D operations. It has no access to the file system, subprocess execution, or unauthorized network exfiltration.
- Sanitization: The script uses JSON.parse for structure and includes type checking, numerical clamping (e.g., heroCard range), and array slicing for card labels to ensure inputs match the expected visual schema.
Audit Metadata