webgl-card-effects

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read project files like src/components/cards/FramedCard.tsx and src/components/cards/cardStyles.ts to understand existing code structure. While reading project files represents a surface for indirect prompt injection, it is the primary intended function of this engineering skill.
  • Ingestion points: src/components/cards/FramedCard.tsx, src/components/cards/cardStyles.ts (File reads).
  • Boundary markers: None present in the instructions to protect the agent from embedded directives within those files.
  • Capability inventory: Access to Read, Write, Bash, Grep, Glob, and Edit tools.
  • Sanitization: No explicit sanitization or filtering of project file content is described.
  • [DYNAMIC_EXECUTION]: The skill implements standard WebGL2 shader compilation and program linking at runtime using gl.compileShader and gl.linkProgram. These operations are procedural and performed on locally defined shader strings without incorporating untrusted remote data.
  • [COMMAND_EXECUTION]: The instructions call for npx tsc --noEmit to verify type safety. This is a routine development command and does not involve the execution of untrusted external scripts or the processing of malicious inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 04:35 PM