threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides examples for loading necessary external decoders and transcoders for compressed asset formats. It specifically references Google's gstatic domain for Draco decoders and the jsDelivr CDN for KTX2 transcoders. Both are well-known and trusted sources for these specific web development resources.
- [INDIRECT_PROMPT_INJECTION]: The primary function of the skill is to load data from external URLs (models, textures, HDR files). This creates an attack surface where a malicious URL could be processed by the agent.
- Ingestion points: File paths and URLs passed to
loader.load()methods andfetch()calls inSKILL.md. - Boundary markers: None are explicitly included in the documentation examples.
- Capability inventory: The skill utilizes network capabilities to fetch assets and rendering capabilities to display them; it does not request high-risk capabilities like shell access or file-system writing.
- Sanitization: The provided examples do not include URL validation or content sanitization, which is standard for a tutorial-focused skill.
Audit Metadata