optimize-tsl
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The benchmark utility script dynamically loads local fixture files using the import function. This behavior is necessary for the tool's primary purpose of testing user-provided shader code.
- [EXTERNAL_DOWNLOADS]: The skill references well-known packages like webgpu, tsx, and three for installation. These are recognized as safe dependencies within the developer ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill processes shader code and fetches component references from an MCP tool. Ingestion points include user-supplied shader code and component sources returned by the threenix MCP tool. No specific boundary markers or sanitization procedures are defined in the instructions to mitigate instructions embedded within this external data. The agent's capabilities include filesystem and GPU access via the benchmarking script, alongside standard command execution tools.
Audit Metadata