pmndrs-xr
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied React code and 3D assets to build interactive environments. It incorporates spatial tracking data from XR hardware during automated validation processes.
- Ingestion points: React components, GLTF models, and XR input state (e.g.,
references/docs/tutorials/anchors.md). - Boundary markers: Not explicitly specified for development-time data processing.
- Capability inventory: Uses
npmfor package installation andvitexecfor automated validation walkthroughs (SKILL.md,references/validation.md). - Sanitization: Standard development workflow; no specific content sanitization is required for this use case.
- [EXTERNAL_DOWNLOADS]: The skill references standard assets and libraries from official vendor repositories and trusted CDNs.
- Evidence: References to
@pmndrs/xrand@react-three/handlepackages, and assets served fromcdn.jsdelivr.net/npm/@webxr-input-profiles/assets. - [COMMAND_EXECUTION]: Instructions guide the agent through routine development tasks using expected CLI tools.
- Evidence: Use of
npm installfor library management andvitexecfor local script execution and validation.
Audit Metadata