threejs-visual-systems
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Fresh-Eyes Review' workflow that involves capturing screenshots and passing them to a subagent for scoring. While this creates an ingestion surface for untrusted visual data, the process is strictly scoped to visual quality assessment and uses structured metrics (JSON) to bound the review context.
- [COMMAND_EXECUTION]: The instructions reference the use of
pnpm inspect:canvasand a specific scriptthreejs-qa-release/scripts/inspect-threejs-canvas.mjsfor rendering diagnostics. These are standard development tools used for performance profiling and are consistent with the skill's technical purpose. - [EXTERNAL_DOWNLOADS]: The skill utilizes the standard
threelibrary and its official addons. These are well-known, trusted packages in the web development ecosystem. - [DYNAMIC_EXECUTION]: The
shader-cookbook.mdprovides recipes for using Three.jsonBeforeCompileto inject GLSL code into standard materials. This is a standard and necessary practice for custom 3D effects and does not involve executing untrusted strings in a general-purpose programming environment.
Audit Metadata