threejs-game-workflow-control
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes system commands such as
git(for state tracking and diffing) andnode(for running unit tests) using Node.jschild_processmodules. These actions are triggered as part of the implementation unit lifecycle and are restricted to paths and commands defined within the skill's internal configuration files. - [EXTERNAL_DOWNLOADS]: The skill depends on the
sharppackage (v0.35.3) for image manipulation tasks. This is a widely used and trusted library in the Node.js ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill processes structured data from various JSON files (e.g.,
work-item.json,execution-state.json) which contain user-supplied descriptions and metadata. Potential risks are mitigated by enforcing strict JSON Schema validation and using dedicated contract verification scripts that isolate semantic content from executable logic.
Audit Metadata