threenix-add-webgpu-canvas
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill facilitates project setup using well-known, legitimate dependencies such as
threeand@react-three/fiber. - [INDIRECT_PROMPT_INJECTION]: The skill includes instructions to read external repository files and documentation to guide integration, which presents an attack surface for indirect prompt injection.
- Ingestion points: Target repository instructions, existing route layouts, and canvas component code (Workflow Step 1).
- Boundary markers: None provided; the agent is not instructed to use delimiters when processing this code.
- Capability inventory: File reading, file writing (copying assets), and command execution (
npm install). - Sanitization: No validation or escaping of ingested repository content is specified. Note: This finding reflects an inherent characteristic of tools that modify source code and does not indicate a specific vulnerability in the skill itself.
Audit Metadata