threejs-3d-generator
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill securely handles API credentials by reading them from the
TRIPO_API_KEYenvironment variable or a command-line argument. It explicitly advises against hardcoding keys in files or reports, adhering to secret management best practices. - [EXTERNAL_DOWNLOADS]: The Python script performs network operations to
api.tripo3d.aito manage 3D generation tasks and download resulting assets. These operations are restricted to the official service domain and are essential for the skill's primary functionality. - [COMMAND_EXECUTION]: The skill utilizes a local Python script for its operations. The script uses standard libraries and does not invoke shells or execute external commands with untrusted input beyond the intended API parameters.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts for 3D generation. While this represents a standard injection surface, the output is passed directly to the Tripo API, and the response (JSON and binary assets) is handled by specific parsing logic that does not grant execution privileges or bypass security controls.
Audit Metadata