webgl-card-effects
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read project files like
src/components/cards/FramedCard.tsxandsrc/components/cards/cardStyles.tsto understand existing code structure. While reading project files represents a surface for indirect prompt injection, it is the primary intended function of this engineering skill. - Ingestion points:
src/components/cards/FramedCard.tsx,src/components/cards/cardStyles.ts(File reads). - Boundary markers: None present in the instructions to protect the agent from embedded directives within those files.
- Capability inventory: Access to
Read,Write,Bash,Grep,Glob, andEdittools. - Sanitization: No explicit sanitization or filtering of project file content is described.
- [DYNAMIC_EXECUTION]: The skill implements standard WebGL2 shader compilation and program linking at runtime using
gl.compileShaderandgl.linkProgram. These operations are procedural and performed on locally defined shader strings without incorporating untrusted remote data. - [COMMAND_EXECUTION]: The instructions call for
npx tsc --noEmitto verify type safety. This is a routine development command and does not involve the execution of untrusted external scripts or the processing of malicious inputs.
Audit Metadata