threejs-primitive-reconstructor
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and scripts focus on creating valid Three.js code using a template and geometric primitives.
- [EXTERNAL_DOWNLOADS]: The skill uses an import map to load Three.js from 'unpkg.com'. This is a standard practice for web development and targets a well-known, public CDN for open-source assets.
- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/write_scene_from_template.py) that performs basic file I/O to copy a template file to a local destination. This is a legitimate utility function within the skill's context and does not exhibit malicious patterns like privilege escalation or exfiltration. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests image descriptions and user prompts to generate code, it provides clear boundary markers and specific formatting rules for the output. The lack of sensitive capabilities (no network writing, no secret access) limits the impact of potential injection.
Audit Metadata