spline-3d-integration
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads JavaScript libraries from the
unpkg.comCDN, a well-known service for hosting NPM packages. This includes the@splinetool/viewerand@splinetool/runtimepackages required for rendering 3D content. - [EXTERNAL_DOWNLOADS]: Instructions are provided to fetch interactive 3D scene files from
prod.spline.design, the official production domain for Spline assets. This is the intended and primary function of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an integration pipeline that ingests external
.splinecodedata files into the client application. While these are domain-specific 3D assets, they constitute a technical ingestion point for external content. The skill mitigates risks by documenting environment-specific validation and recommending local hosting for sensitive production environments. - [COMMAND_EXECUTION]: The documentation includes standard package manager commands (e.g.,
npm install) for the legitimate installation of the Spline runtime libraries.
Audit Metadata