threejs-debug-profiler
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to ingest and process data from potentially untrusted sources such as browser logs and project documents.
- Ingestion points: The agent is instructed to read console errors, page errors, network logs, and Game Design Documents (GDD) (references/scene-debugging.md, SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters used to ensure the agent ignores instructions that might be embedded within the logs or documents being analyzed.
- Capability inventory: The skill is capable of executing
npm testin the shell and writing results back to the filesystem (SKILL.md). - Sanitization: The skill does not implement sanitization or validation of the data retrieved from the browser environment or project files before processing.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
npm testto verify bug fixes and performance regressions (SKILL.md). This is a standard and expected operation within the context of a software development and debugging skill.
Audit Metadata