react-three-fiber
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- External Data Ingestion: The skill defines a
Modelcomponent that enables loading GLTF/GLB assets from external URLs via aurlprop. This is a standard feature for 3D rendering applications but serves as an entry point for external data that the renderer will process. - Structural Validation: The implementation uses Zod schemas (e.g.,
materialSchema,vector3Schema) to validate properties for 3D components. This practice helps ensure that the data processed by the renderer conforms to expected formats, reducing the risk associated with malformed or unexpected input data. - Asset Rendering Surface: As a renderer that interprets JSON specifications to generate 3D scenes, the skill represents an indirect prompt injection surface. The agent processes potentially untrusted JSON data to determine the scene graph. The use of defined catalogs and registries, as shown in the usage patterns, acts as a boundary to limit rendering to specific allowed components.
Audit Metadata