skills/impertio-studio/thatopen-claude-skill-package/thatopen-errors-performance/Gen Agent Trust Hub
thatopen-errors-performance
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to initialize a web worker by fetching a script from
https://unpkg.com/@thatopen/fragments@3.3.6/dist/Worker/worker.mjs. This is a documented, standard pattern for the ThatOpen framework to offload heavy calculations to a background thread and uses a well-known CDN.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze BIM model data, which represents an attack surface where malicious instructions could be embedded in IFC metadata or element properties. - Ingestion points: BIM model data loaded via
IfcLoaderorFragmentsManagerand element properties accessed viagetData. - Boundary markers: No specific delimiters or safety warnings for the agent are provided in the instructions.
- Capability inventory: The skill provides capabilities for GPU resource disposal, scene graph modification, and worker script loading.
- Sanitization: No explicit sanitization of property values or metadata is mentioned before processing.- [DYNAMIC_EXECUTION]: The skill utilizes the
fragments.init()method to load and execute a JavaScript worker script from an external URL. While standard for this framework, it involves runtime loading of executable content.
Audit Metadata