glb-web-export
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous command-line instructions for the agent to execute, primarily using
@gltf-transform/cliandgltfpack. These are standard tools for 3D asset optimization. - The commands include geometry processing (weld, quantize, meshopt, draco) and texture processing (resize, webp, etc1s, uastc).
- The troubleshooting section mentions
xattr -d com.apple.quarantine ./gltfpack, which is a standard procedure on macOS to allow a downloaded binary to run, and does not constitute privilege escalation in this context. - [EXTERNAL_DOWNLOADS]: The skill references several external resources, all of which are established and reputable.
- It utilizes
npxto run tools from the npm registry. - The
scripts/package.jsonfile lists standard dependencies such as@gltf-transform/core,draco3dgltf, andmeshoptimizer. - Remote documentation and decoder sources point to trusted domains including
khronos.org,google.com(Google CDN for Draco decoders), andbabylonjs.com(Babylon CDN). - The skill script
scripts/glb-audit.shperforms annpm installto set up its local environment, which is standard behavior for Node.js-based tooling. - [DATA_HANDLING]: The skill is designed to audit and process user-supplied 3D models. It includes a custom auditing script (
scripts/glb-audit.mjs) that calculates file metrics (triangles, draw calls, VRAM) locally without exfiltrating data to external servers.
Audit Metadata