threejs-3d-generator
Warn
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The instructions direct the agent to source user shell configuration files, such as
~/.zshrcand~/.zprofile, usingzsh -c. This is performed to extract environment variables like theTRIPO_API_KEYbut represents a high-privilege operation that grants the agent access to the user's interactive shell environment. - [EXTERNAL_DOWNLOADS]: The skill depends on an external script,
probe_asset_credentials.sh, which is located in a different skill's directory (~/.claude/skills/threejs-game-director/). Because this script is not provided with the audited package, its behavior and safety cannot be verified. - [EXTERNAL_DOWNLOADS]: The
threejs_3d_asset.pytool downloads 3D assets (GLB, FBX) and preview images fromapi.tripo3d.ai. This is a well-known service for 3D asset generation. - [COMMAND_EXECUTION]: The skill's workflow involves frequent execution of a Python script (
threejs_3d_asset.py) that performs network requests and writes binary data to the local file system in user-specified project directories.
Audit Metadata