threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external assets and libraries from well-known technology services, specifically fetching Draco decoders from Google's gstatic infrastructure and KTX2 transcoders from the jsdelivr CDN. These are standard dependencies for processing compressed 3D geometry and textures.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data by providing patterns for loading 3D models and textures from remote URLs. While this creates a data ingestion surface, it is consistent with the skill's primary purpose and relies on established library loaders.
- [DATA_EXPOSURE]: Includes examples of network operations using standard web APIs (fetch) and library-specific loaders to retrieve assets. The analysis found no evidence of sensitive local file access or credential harvesting.
Audit Metadata