threejs-polish-builder
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard development commands to maintain quality and performance.
- The agent is instructed to run
npm testafter implementing changes to ensure code integrity (SKILL.md). - The
npm run inspect:canvascommand is used to compare live diagnostics against the defined render budget (technical-art.md). - [SAFE]: The skill implements established industry practices for high-performance 3D graphics in the browser.
- It provides detailed recipes for PBR materials, procedural geometry, and shader optimization using Three.js (shader-cookbook.md).
- It establishes a clear technical art contract with performance targets for draw calls, triangles, and memory usage (technical-art.md).
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external game design documentation.
- Ingestion points: The skill requires reading an active Game Design Document (GDD) and approved target images to guide the polish process (SKILL.md).
- Boundary markers: Explicit delimiters or warnings to ignore instructions within the ingested GDD are absent.
- Capability inventory: The agent has the ability to execute shell commands (
npm test), write results back to the GDD, and interact with theblender-mcptool (SKILL.md). - Sanitization: There is no mention of sanitizing or validating the content of the GDD before processing.
Audit Metadata