threejs-debug-profiler

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to ingest and process data from potentially untrusted sources such as browser logs and project documents.
  • Ingestion points: The agent is instructed to read console errors, page errors, network logs, and Game Design Documents (GDD) (references/scene-debugging.md, SKILL.md).
  • Boundary markers: There are no explicit instructions or delimiters used to ensure the agent ignores instructions that might be embedded within the logs or documents being analyzed.
  • Capability inventory: The skill is capable of executing npm test in the shell and writing results back to the filesystem (SKILL.md).
  • Sanitization: The skill does not implement sanitization or validation of the data retrieved from the browser environment or project files before processing.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute npm test to verify bug fixes and performance regressions (SKILL.md). This is a standard and expected operation within the context of a software development and debugging skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 08:24 PM