threejs-game
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The open tool provides the capability to execute shell commands such as 'bunx vite' to manage local development servers during the build and test process.
- [DYNAMIC_EXECUTION]: The skill includes an eval tool designed for runtime JavaScript execution within the headless browser context to facilitate scene inspection and debugging.
- [DYNAMIC_EXECUTION]: The performance optimization workflow utilizes a minified runtime component, three-runtime.js, which is automatically provided and managed by the skill's performance tools.
- [EXTERNAL_DOWNLOADS]: The asset_search functionality allows for the retrieval of 3D models and PBR textures from external libraries and generation services like fal, Meshy, and Tripo.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including web page content and 3D model files, which represents a potential indirect prompt injection surface; however, this is mitigated by the use of a sandboxed headless browser environment.
Audit Metadata