threejs-debug-profiler
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill defines workflows that ingest untrusted external data, creating an attack surface for indirect prompt injection.
- Ingestion points: According to
references/debug-profile-checklists.md, the agent analyzes console logs, network error responses, and 3D asset components (glTF buffers/textures). - Boundary markers: The instructions lack specific guidance on using delimiters or safety markers to isolate external data from the agent's core instructions.
- Capability inventory: The
SKILL.mdworkflow expects the agent to perform code modifications ('Fix the cause in the owning module') and report execution commands based on the analyzed data. - Sanitization: There are no defined procedures for sanitizing or validating the content of external logs or assets before the agent interprets them.
- [NO_CODE]: The skill consists entirely of markdown instructions and checklists, with no executable scripts or binaries included.
Audit Metadata