add-3d-assets

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands like grep, test, cp, and npm run to manage environment variables, copy assets, and build the project. It also runs local scripts using node. These commands are standard for the skill's functionality as a development tool for Three.js games.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from the user's project by reading package.json, src/core/Constants.js, and JavaScript files in src/gameplay/ and src/entities/. No explicit boundary markers or instructions to ignore embedded commands are used during this ingestion. The skill possesses capabilities to write files (such as src/level/AssetLoader.js), modify code, and execute local scripts. No sanitization of the ingested source code content is performed before it is used to plan asset replacement, creating a surface for indirect prompt injection where malicious comments in the project code could influence agent behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 10:07 AM