threejs-aaa-graphics-builder
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill identifies a workflow where the agent must capture or inspect active desktop and mobile screenshots to perform a visual critique and score the game's graphics. This ingestion of untrusted visual data represents an indirect prompt injection surface, as an attacker could potentially embed instructions in the game's textures or UI that influence the agent's code generation.
- Ingestion points:
SKILL.md(Workflow Step 1),references/prompt-templates.md(Capture active gameplay desktop and mobile screenshots). - Boundary markers: Absent. The skill does not instruct the agent to ignore or delimit instructions found within the processed screenshots.
- Capability inventory: The skill generates and modifies complex TypeScript/JavaScript code for Three.js factories, materials, and rendering systems, and can invoke secondary generative skills (
threejs-3d-generator,threejs-image-generator). - Sanitization: Absent. No specific sanitization or filtering logic is provided for the visual data before it is used to drive architectural changes.
Audit Metadata