webgl-liquid-metal
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes an example HTML file that compiles GLSL shaders at runtime using standard WebGL2 APIs (
gl.compileShader). This is a standard and legitimate method for rendering real-time generative graphics and does not introduce security risks beyond the existing browser sandbox. - [INDIRECT_PROMPT_INJECTION]: The instructions suggest mapping accent colors from an external
DESIGN.mdfile if one is present in the project context. While this represents a data ingestion point for untrusted content, the data is restricted to visual styling parameters (hex colors) and is not used in any sensitive execution path or system command. - [SAFE]: The workflow explicitly mandates the production of a single file with 'zero external requests', which proactively prevents common attack vectors like data exfiltration, remote script loading, or unauthorized third-party communication. All referenced resources trace back to the recognized vendor 'nexu-io'.
Audit Metadata