threejs-builder

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements a robust 'Phased Construction' pattern (Design, Build, Animate, Polish) that guides the AI agent through a structured development lifecycle. It includes automatic paradigm detection to ensure that code is generated using the correct architecture (Imperative, R3F, or WebGPU), which reduces logical errors and potential script failures.- [SAFE]: All external libraries and assets referenced in the templates are sourced from established and trusted services, including unpkg.com, jsdelivr.net, and Google's gstatic.com. These are standard practices for front-end development and do not involve untrusted remote code execution.- [SAFE]: The skill uses standard developer tools (Bash, Write, Edit, Task) to manage project files and execute local builds. The instructions emphasize building only what is requested and following repository-specific standards found in CLAUDE.md, demonstrating a focus on security and compliance.- [INDIRECT_PROMPT_INJECTION]: As a code generation tool, the skill is naturally exposed to user-provided instructions which could theoretically attempt to inject malicious code. However, the skill mitigates this risk through a highly structured scene-graph approach and modular code templates that enforce best practices. Ingestion points: User requests for 3D visualizations and scenes; Boundary markers: The 'Scene Plan' template and phased verification gates; Capability inventory: File system access (Write, Edit) and command execution (Bash); Sanitization: Relies on the agent's core safety guardrails as the skill itself does not process external untrusted data beyond the user prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 05:19 PM
Security Audit — agent-trust-hub — threejs-builder