threejs-polish-builder

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard development commands to maintain quality and performance.
  • The agent is instructed to run npm test after implementing changes to ensure code integrity (SKILL.md).
  • The npm run inspect:canvas command is used to compare live diagnostics against the defined render budget (technical-art.md).
  • [SAFE]: The skill implements established industry practices for high-performance 3D graphics in the browser.
  • It provides detailed recipes for PBR materials, procedural geometry, and shader optimization using Three.js (shader-cookbook.md).
  • It establishes a clear technical art contract with performance targets for draw calls, triangles, and memory usage (technical-art.md).
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external game design documentation.
  • Ingestion points: The skill requires reading an active Game Design Document (GDD) and approved target images to guide the polish process (SKILL.md).
  • Boundary markers: Explicit delimiters or warnings to ignore instructions within the ingested GDD are absent.
  • Capability inventory: The agent has the ability to execute shell commands (npm test), write results back to the GDD, and interact with the blender-mcp tool (SKILL.md).
  • Sanitization: There is no mention of sanitizing or validating the content of the GDD before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 08:24 PM