add-webgpu-canvas
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the well-known libraries '@react-three/fiber' and 'three' from the official npm registry.
- [COMMAND_EXECUTION]: The workflow requires running 'npm install' to manage dependencies and executing project-specific build or type-check scripts to verify the integration.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the target repository which represents a potential attack surface.
- Ingestion points: Reads local instructions and file structures from the target repository to determine integration steps.
- Boundary markers: No delimiters are specified to separate external repository content from the agent's instructions.
- Capability inventory: The skill has the ability to write components to the file system, install packages via npm, and execute shell commands for build verification.
- Sanitization: No sanitization or validation of the ingested repository content is performed.
Audit Metadata