threejs-particle-morph
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Three.js library from unpkg.com, a well-known CDN for NPM packages. It also references asset files (HTML/CSS/JS) from the author's public GitHub repository (Rheinmir/uiux-asset).
- [INDIRECT_PROMPT_INJECTION]: The skill accepts an external imageUrl which is processed to extract pixel data for particle positioning.
- Ingestion points: The imageUrl parameter in assets/demo.js allows the skill to load external images.
- Boundary markers: No explicit instruction-ignoring delimiters are used for the image source.
- Capability inventory: The skill is limited to canvas pixel manipulation and WebGL rendering; it has no capabilities for file system modification, command execution, or network exfiltration.
- Sanitization: The skill applies alpha and brightness thresholds to pixels but does not validate the content of the image.
Audit Metadata