frost-sequence-camera-orbit
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches 3D assets, such as texture maps and font files, from the author's official CDN (static.heygen.ai). These are required for the visual rendering and are sourced from a domain associated with the skill's verified author.
- [OBFUSCATION]: Static analysis flagged a large hex-encoded blob in the bundled script
assets/frost.js. A review of the provided source code confirms this file is a bundled version of the Three.js WebGPU engine. The hex data corresponds to binary data for 3D textures, geometry buffers, and precompiled shaders, which is standard for high-performance graphics applications. - [DATA_EXPOSURE]: The skill uses
indexedDBvia a local cache implementation (source/src/cache.ts) to store deterministic build products (like extruded geometries and distance fields). This is used strictly for performance optimization and does not involve sensitive user data. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided strings for headlines (
headline1,headline2) and a path for an SVG logo (logoUrl). The SVG path is strictly validated to ensure it is a local project asset or a data URI, preventing arbitrary remote resource fetching. The text strings are processed through a font-outline generator (opentype.js) to create 3D meshes, which provides a natural boundary that prevents the input from being interpreted as code or instructions.
Audit Metadata