asset-runtime
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official documentation from trusted and well-known technology organizations including Three.js (threejs.org), Godot (docs.godotengine.org), and Mozilla (developer.mozilla.org). These links are provided for developer reference and involve no automated execution or data exfiltration.
- [INDIRECT_PROMPT_INJECTION]: The
assets/evals.jsonfile includes a prompt labeled as 'adversarial' which is intended to test the agent's ability to reject unsafe practices (such as ignoring memory leaks or fabricating evidence). This is a standard evaluation surface for AI agents and does not constitute a malicious injection against the system or user. - [NO_CODE]: The skill consists exclusively of Markdown documentation and JSON configuration/test data. There are no scripts, executables, or dynamic context injection commands (
!command) that would allow for runtime code execution or privilege escalation.
Audit Metadata