glb-web-export

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous command-line instructions for the agent to execute, primarily using @gltf-transform/cli and gltfpack. These are standard tools for 3D asset optimization.
  • The commands include geometry processing (weld, quantize, meshopt, draco) and texture processing (resize, webp, etc1s, uastc).
  • The troubleshooting section mentions xattr -d com.apple.quarantine ./gltfpack, which is a standard procedure on macOS to allow a downloaded binary to run, and does not constitute privilege escalation in this context.
  • [EXTERNAL_DOWNLOADS]: The skill references several external resources, all of which are established and reputable.
  • It utilizes npx to run tools from the npm registry.
  • The scripts/package.json file lists standard dependencies such as @gltf-transform/core, draco3dgltf, and meshoptimizer.
  • Remote documentation and decoder sources point to trusted domains including khronos.org, google.com (Google CDN for Draco decoders), and babylonjs.com (Babylon CDN).
  • The skill script scripts/glb-audit.sh performs an npm install to set up its local environment, which is standard behavior for Node.js-based tooling.
  • [DATA_HANDLING]: The skill is designed to audit and process user-supplied 3D models. It includes a custom auditing script (scripts/glb-audit.mjs) that calculates file metrics (triangles, draw calls, VRAM) locally without exfiltrating data to external servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 07:54 PM