threejs-game-qa-performance
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON files for layout contracts and identity validation. These inputs could potentially be used to influence the agent's behavior if the data contains hidden instructions, although the skill performs standard JSON parsing and technical validation.
- Ingestion points: The skill reads JSON data from files passed via the
--contractand--identityCLI arguments inscripts/responsive-visual-validation.mjs. - Boundary markers: None identified; the skill relies on technical data structures.
- Capability inventory: Filesystem writes (
fs.writeFile), network navigation via a browser (page.goto), and screenshot capture. - Sanitization: Data is processed through
JSON.parseand normalized for geometric calculations. - [COMMAND_EXECUTION]: The skill executes Node.js scripts and utilizes the Playwright library to perform automated browser interactions. This execution is necessary for the skill's primary purpose of capturing stable frames and measuring CSS/DOM properties in a Three.js environment.
- [EXTERNAL_DOWNLOADS]: The skill depends on Playwright, a well-known library that may download browser binaries (such as Chromium) during its initialization or execution phase to facilitate headless testing.
Audit Metadata