threenix-optimize-tsl
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and refactor untrusted TSL TypeScript shader code provided by users. The instructions do not define boundary markers or sanitization requirements for this input data. Given the skill's ability to interface with external tools such as the
threenixMCP server (viaget_component_reference) and other agent skills (via$threenix-benchmark-webgpu), this creates an attack surface where malicious instructions hidden in shader code could potentially influence agent behavior. - [EXTERNAL_DOWNLOADS]: The skill provides a link to the official Three.js Shading Language documentation on GitHub as a reference for TSL implementation details. This is a reference to a well-known and trusted project.
Audit Metadata