threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes configuration examples that download Draco decoders and KTX2 transcoders from well-known services, including Google's static storage (gstatic.com) and the jsDelivr CDN. These are standard, industry-recognized sources for these dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from 3D model files (such as GLB, OBJ, and FBX) which may contain attacker-controlled metadata or animations.
- Ingestion points: Data ingestion occurs through
GLTFLoader.load(),OBJLoader.load(), andFBXLoader.load()methods documented inSKILL.md. - Boundary markers: Absent; there are no specific markers or instructions to isolate or ignore potentially malicious content embedded within the 3D assets.
- Capability inventory: The skill demonstrates capabilities for network operations (
fetch,loader.load) and file system interaction for asset management. - Sanitization: Absent; the code relies on standard library parsing without additional validation of the ingested asset data.
Audit Metadata