threejs-aaa-graphics-builder
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze existing Three.js project source code and active-play screenshots, creating a potential surface for malicious instructions embedded in external data.
- Ingestion points: existing game codebases and screenshots (SKILL.md).
- Boundary markers: none present in instructions.
- Capability inventory: file system modification and local script execution (references/visual-scorecard.md).
- Sanitization: none specified.
- [COMMAND_EXECUTION]: The instructions direct the agent to execute local scripts and environment probes for diagnostic purposes.
- Evidence: references to
threejs-game-director/scripts/probe_asset_credentials.shandnpm run inspect:canvas(SKILL.md, references/technical-art.md).
Audit Metadata