thatopen-core-fragments

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill describes initializing a web worker from unpkg.com, a well-known CDN for serving NPM packages. This is a standard functional requirement for the library to handle geometry processing off the main thread.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides guidance on ingesting external IFC files and fragment binaries, which represents a potential attack surface for indirect prompt injection if the BIM metadata or properties contain malicious instructions.
  • Ingestion points: IfcLoader.load and binary fragment loading through FragmentsManager demonstrated in SKILL.md and references/examples.md.
  • Boundary markers: None explicitly mentioned in the code examples.
  • Capability inventory: Data extraction via getData, raycast, and geometry queries like getPositions and getBBoxes.
  • Sanitization: No specific sanitization or validation of IFC data is shown in the provided snippets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 02:11 PM