threejs-3d-generator
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided prompts that are sent to the Tripo API for asset generation, creating a surface for instructions to be embedded in data. 1. Ingestion points: prompt argument in threejs_3d_asset.py. 2. Boundary markers: Absent. 3. Capability inventory: Network operations (urllib) and file-writes (Path.write_bytes) in threejs_3d_asset.py. 4. Sanitization: Absent.
- [COMMAND_EXECUTION]: SKILL.md instructs the agent to execute an external bash script probe_asset_credentials.sh to determine API key status.
- [EXTERNAL_DOWNLOADS]: threejs_3d_asset.py downloads 3D model files and metadata from the Tripo API domain.
Audit Metadata