exploded-view
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The demonstration page fetches the Three.js library from the JSDelivr CDN, which is a well-known service for serving open-source packages.
- [INDIRECT_PROMPT_INJECTION]: The skill processes 3D model metadata, such as node names and custom user data, to generate UI labels and drive interactive animations.
- Ingestion points: The skill reads part names and
userDataproperties from 3D objects (e.g., from loaded GLB files) inassets/explode.jsandassets/demo/motor.js. - Boundary markers: None are present; the skill assumes the provided model metadata is trusted and correct for the technical explainer.
- Capability inventory: The skill generates HTML and SVG elements for labels and handles interactive hover/click events via a
Pickerclass inassets/explode.js. - Sanitization: No specific sanitization or filtering is applied to part names before they are rendered as text content in the labels.
Audit Metadata