threejs-particle-canvas
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The "Infinite Gallery Tunnel" mode features a design where external data (image URLs) is injected via a bridge from the
image-wellskill to populate the visualization. - Ingestion points:
assets/tunnel-gallery-source.htmlcontains a sentinel comment (// IMAGES_INJECTION_POINT) used by the bridge to inject image data into a constant. - Boundary markers: Data is expected to be placed within a JavaScript array assignment.
- Capability inventory: The skill generates static frontend code; it does not execute system commands or perform sensitive file operations based on this input.
- Sanitization: Content is expected to be structured as a URL manifest.
- [DYNAMIC_EXECUTION]: The skill includes functionality to generate code, specifically through
scripts/vinyl_showcase_generator.py, which assembles HTML and JavaScript for 3D product showcases. This is an intended feature of the skill. - [EXTERNAL_DOWNLOADS]: Generated templates and reference files reference the Three.js library and media assets from established and reputable sources including jsdelivr.net, cdnjs.com, and supabase.co. These references are standard for the intended WebGL functionality.
Audit Metadata