add-3d-assets
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands like
grep,test,cp, andnpm runto manage environment variables, copy assets, and build the project. It also runs local scripts usingnode. These commands are standard for the skill's functionality as a development tool for Three.js games.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from the user's project by readingpackage.json,src/core/Constants.js, and JavaScript files insrc/gameplay/andsrc/entities/. No explicit boundary markers or instructions to ignore embedded commands are used during this ingestion. The skill possesses capabilities to write files (such assrc/level/AssetLoader.js), modify code, and execute local scripts. No sanitization of the ingested source code content is performed before it is used to plan asset replacement, creating a surface for indirect prompt injection where malicious comments in the project code could influence agent behavior.
Audit Metadata