threejs-game
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download dependencies via npm (
three,vite) and references assets from a well-known CDN (jsdelivr.net). These are standard practices for web development and use reputable services. - [COMMAND_EXECUTION]: The documentation includes standard shell commands for project setup (
npm init,npm install) and script execution through Vite. These commands are typical for the skill's stated purpose of scaffolding a development environment. - [INDIRECT_PROMPT_INJECTION]: The skill implements an
InputSystemthat ingests external data from the gyroscope, touch events, and keyboard. This represents a data ingestion surface; however, the data is processed as numeric coordinates for game logic, and the skill provides a robust architectural framework for handling this input safely. - [SAFE]: All code patterns, including the EventBus and GameState singletons, represent standard game architecture design. No evidence of obfuscation, persistence, or data exfiltration was found in the provided templates and documentation.
Audit Metadata