threejs-debugging
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard developer CLI tools, including git (log, blame, tag, branch) and npm (view), as detailed in 'references/upstream-research.md' for retrieving project history and package metadata.
- [INDIRECT_PROMPT_INJECTION]: The research workflow creates a surface for indirect prompt injection by processing external content. 1. Ingestion points: GitHub issues, pull requests, and commit data are analyzed in 'references/upstream-research.md'. 2. Boundary markers: No explicit markers are defined to isolate untrusted content from the agent's instructions. 3. Capability inventory: The skill uses git and npm CLI tools for information gathering in 'references/upstream-research.md'. 4. Sanitization: There is no automated sanitization of external text, although the methodology emphasizes verification against primary source code.
Audit Metadata