thatopen-core-fragments
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill describes initializing a web worker from unpkg.com, a well-known CDN for serving NPM packages. This is a standard functional requirement for the library to handle geometry processing off the main thread.
- [INDIRECT_PROMPT_INJECTION]: The skill provides guidance on ingesting external IFC files and fragment binaries, which represents a potential attack surface for indirect prompt injection if the BIM metadata or properties contain malicious instructions.
- Ingestion points:
IfcLoader.loadand binary fragment loading throughFragmentsManagerdemonstrated inSKILL.mdandreferences/examples.md. - Boundary markers: None explicitly mentioned in the code examples.
- Capability inventory: Data extraction via
getData,raycast, and geometry queries likegetPositionsandgetBBoxes. - Sanitization: No specific sanitization or validation of IFC data is shown in the provided snippets.
Audit Metadata