3d-web-experience
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several standard industry packages such as
@react-three/fiber,@react-three/drei, andgsap. It also suggests installing the@gltf-transform/clipackage globally via npm for 3D asset optimization. - [COMMAND_EXECUTION]: Provides instructions for executing shell commands to optimize 3D models using the
gltf-transformutility. These commands are localized to asset preparation and do not involve privilege escalation or sensitive system access. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by processing external assets.
- Ingestion points: External 3D scenes and GLB models are loaded via URLs or file paths in
SKILL.md. - Boundary markers: None identified in the provided instructions.
- Capability inventory: The skill uses
npmfor package installation and shell commands for model optimization (gltf-transform). - Sanitization: No specific sanitization or validation of the external asset content is described beyond standard library loading.
Audit Metadata