threejs-aaa-graphics-builder
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes the Three.js onBeforeCompile hook to dynamically generate and inject GLSL code into shader programs at runtime, as documented in the shader cookbook for various visual effects.
- [COMMAND_EXECUTION]: Guidelines in the visual scorecard and prompt templates instruct the agent to execute local shell commands and scripts, specifically npm run inspect:canvas, to gather performance data.
- [INDIRECT_PROMPT_INJECTION]: The agent ingests and processes external screenshots and JSON-formatted metrics (ingestion points in references/visual-scorecard.md). No explicit boundary markers or sanitization processes are defined. The agent has capabilities to execute local commands and modify project files, creating a vulnerability surface for untrusted data to influence behavior.
- [CREDENTIALS_UNSAFE]: The skill includes a credential probe mechanism that requires the agent to verify and report the presence of API keys in the environment, which reveals information about the platform's security configuration.
Audit Metadata