webgl-expert
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The textured-cube.md example fetches the gl-matrix library from cdnjs.cloudflare.com. This targets a well-known service for hosting web libraries.
- Evidence: The script tag in
examples/textured-cube.mdreferenceshttps://cdnjs.cloudflare.com/ajax/libs/gl-matrix/2.8.1/gl-matrix-min.js. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external content, creating a potential attack surface if an agent follows these steps with untrusted inputs.
- Ingestion points: The
loadTexturefunction inSKILL.mdandexamples/textured-cube.mdaccepts external URLs, and shader compilation functions process raw source code strings. - Boundary markers: The skill explicitly recommends security best practices, such as validating shader code and configuring CORS for cross-origin textures.
- Capability inventory: The skill is focused on graphics rendering within the WebGL API and does not include scripts for file system access, shell execution, or arbitrary network operations.
- Sanitization: Instructions include guidance on enforcing resource limits and performing shader source validation.
Audit Metadata