threejs-particle-morph
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Three.js library from unpkg.com, a well-known CDN for NPM packages. It also references source code assets and live demos from the author's public GitHub repository (rheinmir/uiux-asset). These external references are standard for the skill's purpose and align with the author's stated identity.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing image data from a user-supplied URL. This data is sampled for pixel coordinates and color values to drive the visual effect. The skill does not possess capabilities (such as command execution or sensitive file access) that would allow this data ingestion to be exploited for malicious purposes.
- [SAFE]: The implementation follows best practices for Three.js resource management, including explicit disposal of geometries, materials, and renderers to prevent memory leaks. No obfuscation, persistence mechanisms, or unauthorized credential access patterns were found.
Audit Metadata