threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Draco decoders from Google's official static content delivery network (gstatic.com) and Basis/KTX2 transcoders from the jsDelivr CDN (cdn.jsdelivr.net). These are well-known and standard sources for these specific Three.js support libraries.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external 3D models (GLTF, FBX, OBJ) and textures. This is the primary intended purpose of the skill; while external data formats are a potential injection surface, the skill utilizes standard, well-maintained libraries for parsing these assets.
- Ingestion points: SKILL.md (via
loader.loadandfetchsnippets) - Boundary markers: N/A (standard asset loading)
- Capability inventory: File reading and network requests for asset retrieval
- Sanitization: Relies on internal Three.js loader sanitization of asset files.
Audit Metadata