code-built-3d
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a self-contained 3D engine using three.js. It explicitly enforces a 'zero-images' and 'zero-external-resources' policy.
- [SAFE]: The
scripts/serve.mjsis a standard local static file server used to bypass browser CORS restrictions for ES modules. It is restricted to serving files within the skill directory. - [SAFE]: The dependencies in
assets/vendor/(three.js and BufferGeometryUtils) are well-known, open-source 3D library files under the MIT license. - [SAFE]: The
scripts/check.mjsscript uses Playwright for automated testing of the 3D scene. While it launches a browser, it is for local acceptance testing and specifically monitors for (and blocks) any requests leaving the local server context. - [SAFE]: No obfuscation, hardcoded credentials, or data exfiltration patterns were detected in the source code or assets.
Audit Metadata