threejs-visual-systems

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Fresh-Eyes Review' workflow that involves capturing screenshots and passing them to a subagent for scoring. While this creates an ingestion surface for untrusted visual data, the process is strictly scoped to visual quality assessment and uses structured metrics (JSON) to bound the review context.
  • [COMMAND_EXECUTION]: The instructions reference the use of pnpm inspect:canvas and a specific script threejs-qa-release/scripts/inspect-threejs-canvas.mjs for rendering diagnostics. These are standard development tools used for performance profiling and are consistent with the skill's technical purpose.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the standard three library and its official addons. These are well-known, trusted packages in the web development ecosystem.
  • [DYNAMIC_EXECUTION]: The shader-cookbook.md provides recipes for using Three.js onBeforeCompile to inject GLSL code into standard materials. This is a standard and necessary practice for custom 3D effects and does not involve executing untrusted strings in a general-purpose programming environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:18 PM