threejs-scene
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a robust framework for procedural 3D development. All identified code and instructions are consistent with its stated purpose of building WebGL scenes.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests configuration data through URL parameters (
?view,?light,?quality,?record) inmain.js. - Ingestion points:
main.jsprocesseslocation.searchat runtime. - Boundary markers: Not applicable as input is restricted to short configuration strings.
- Capability inventory: The skill is limited to 3D rendering and camera manipulation via Three.js; it has no access to sensitive files, network APIs (beyond CDN assets), or system commands.
- Sanitization: Input parameters are strictly validated against whitelists (e.g.,
VANTAGEkeys,TIERSarray) before use. This surface is considered safe. - [EXTERNAL_DOWNLOADS]: The skill fetches the Three.js library from a well-known CDN (JSDelivr) with a specific version pinned (
three@0.169.0). This is a standard and safe practice for web-based 3D applications.
Audit Metadata