assemble-scene
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references loading external physics modules, specifically Ammo.js (WASM and glue scripts), which is the standard physics engine for PlayCanvas applications. The skill also mentions the
sync-ammopeer dependency for React projects, which is a common utility in the vendor ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill involves generating code based on external metadata such as model names, bounds, and tuning records. While this presents a theoretical surface for indirect injection if inputs are unvalidated, it represents standard functionality for scene assembly tasks.
- Ingestion points: Model names, object roles, measured bounds, and tuning records referenced in SKILL.md.
- Boundary markers: None explicitly defined in the provided guidelines.
- Capability inventory: Generates scene hierarchies and physics configurations using the PlayCanvas Engine API, React components, and Web Components.
- Sanitization: The skill does not specify sanitization for these metadata inputs, relying on the agent's implementation logic.
Audit Metadata