webgl
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
gl-matrixpackage, which is a well-known and standard library for performing matrix and vector operations in graphics programming. - [INDIRECT_PROMPT_INJECTION]: The
loadTextureutility fetches content from an external URL provided at runtime, creating a surface for processing untrusted data. - Ingestion points: The
urlparameter in theloadTexturefunction inSKILL.mdallows the agent to fetch resources from external network locations. - Boundary markers: No delimiters or explicit instructions to ignore embedded content are used in the provided code snippets.
- Capability inventory: The skill interacts exclusively with the WebGL rendering context and does not have access to sensitive capabilities such as the file system, subprocess execution, or arbitrary code evaluation.
- Sanitization: The fetched resource is converted to an image bitmap for GPU upload, but the snippet does not include validation for the URL source or the integrity of the returned data.
Audit Metadata