threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external resources to support specialized 3D formats:
- Fetches Draco geometry decoders from Google's versioned static content domain (
gstatic.com). - Downloads KTX2/Basis transcoder libraries from the official Three.js package hosted on the JSDelivr CDN.
- These downloads are from well-known services and are standard requirements for loading compressed 3D assets.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to ingest and process external 3D data files (GLTF, FBX, OBJ, STL, PLY).
- Ingestion points: External files are loaded via specialized loaders such as
GLTFLoader.loadandOBJLoader.loadinSKILL.md. - Boundary markers: None; these are standard library calls for processing binary or text-based 3D data formats.
- Capability inventory: The skill primarily manipulates the 3D scene graph (
scene.add) and does not invoke system-level commands, subprocesses, or network exfiltration. - Sanitization: None; the skill relies on the underlying Three.js library's parsing logic. As asset loading is the primary purpose of the skill, this is considered a standard operational surface.
Audit Metadata