threenix-add-mesh-surface-sampled-particles
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and act upon instructions found within the user's repository, which serves as an untrusted input surface.
- Ingestion points: Target repository instructions and manifest files (SKILL.md).
- Boundary markers: None specified to differentiate between repository content and agent instructions.
- Capability inventory: File writing, dependency installation, and build command execution (SKILL.md).
- Sanitization: No explicit sanitization or validation of the ingested repository instructions is defined.
- [EXTERNAL_DOWNLOADS]: The skill fetches external code and assets, such as GLB models, through the threenix MCP server.
- [COMMAND_EXECUTION]: The agent is instructed to execute local shell commands for package management and build verification during the integration process.
Audit Metadata