threejs-loaders
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides examples that fetch auxiliary libraries and decoders from well-known services.
- Fetches Draco decoders from Google's official static content domain (gstatic.com).
- Fetches KTX2/Basis transcoders from the jsDelivr CDN repository for Three.js.
- [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting external data (such as GLTF files or textures) into the application context.
- Ingestion points:
loader.load(),fetch(), andloader.parse()methods used to process external binary and text data. - Capability inventory: The skill examples include network fetching and file parsing capabilities.
- This represents a standard application attack surface where maliciously crafted assets could attempt to influence the agent's behavior if it interprets metadata from the loaded objects.
Audit Metadata