threejs-scene

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides a robust framework for procedural 3D development. All identified code and instructions are consistent with its stated purpose of building WebGL scenes.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests configuration data through URL parameters (?view, ?light, ?quality, ?record) in main.js.
  • Ingestion points: main.js processes location.search at runtime.
  • Boundary markers: Not applicable as input is restricted to short configuration strings.
  • Capability inventory: The skill is limited to 3D rendering and camera manipulation via Three.js; it has no access to sensitive files, network APIs (beyond CDN assets), or system commands.
  • Sanitization: Input parameters are strictly validated against whitelists (e.g., VANTAGE keys, TIERS array) before use. This surface is considered safe.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the Three.js library from a well-known CDN (JSDelivr) with a specific version pinned (three@0.169.0). This is a standard and safe practice for web-based 3D applications.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 01:53 PM