skills/wollfoo/setup-opencode/threejs/Gen Agent Trust Hub

threejs

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides numerous templates for loading external assets (3D models, textures, animations) from remote or local paths.
  • Ingestion points: Files references/02-loaders.md, references/03-textures.md, and references/15-specialized-loaders.md contain instructions for using GLTFLoader, TextureLoader, SVGLoader, etc., to ingest external data.
  • Boundary markers: None identified. There are no warnings or delimiters used to separate user-provided asset paths or content from the agent's instructions.
  • Capability inventory: The skill facilitates network requests (asset loading) and DOM manipulation (appending renderers/UIs).
  • Sanitization: No input validation or sanitization of file paths or loaded content is demonstrated in the provided snippets.
  • [DYNAMIC_EXECUTION]: The skill demonstrates the creation and execution of custom shaders (GLSL and WGSL) via strings passed to Three.js materials.
  • Evidence: references/11-materials-advanced.md uses ShaderMaterial with raw GLSL strings. references/09-postprocessing.md does the same for post-processing effects. references/16-webgpu.md demonstrates compute shaders using TSL/WGSL.
  • This is a standard feature of the library but involves runtime compilation of code strings for GPU execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 10:19 PM