img2threejs
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of image URLs, base64 data, or file objects to analyze their visual characteristics. This creates a surface where instructions could potentially be embedded in image metadata or textual content within the image (OCR) to influence the generated output.
- Ingestion points: Image URLs, base64 encoded strings, and File objects provided by the user.
- Boundary markers: None present. The skill does not define specific delimiters to separate the image data analysis from the generation logic.
- Capability inventory: Generates JavaScript and TypeScript code for rendering 3D scenes in the browser. It does not appear to execute this code within the agent's restricted environment.
- Sanitization: No specific sanitization or integrity checks for the source images are defined in the instructions.
- [EXTERNAL_DOWNLOADS]: The skill's metadata references external documentation and sources, including the official Three.js repository and a third-party documentation site (context7.com). While these are informational references, users should ensure they are using official documentation for security-sensitive development.
Audit Metadata