High-Precision 3D Web Optimize

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.2.0

Overview

The skill appears to be a normal local 3D asset optimizer, with some dependency and output-verification caveats but no evidence of hidden or malicious behavior.

Install and run this only in a normal project or sandbox with reviewed, pinned npm dependency versions and a lockfile. Use it for local GLB/GLTF optimization, then visually inspect the generated LOD assets and verify the manifest before feeding results into production or automated delivery systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/package-template.json:7

Finding

Unpinned npm Dependencies Use Mutable Latest Versions

Content

View full analysis

Vulnerability Details

File Location: references/package-template.json, lines 7–12
Vulnerability Type: Supply-chain risk caused by unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

json

"@gltf-transform/core": "latest",
"@gltf-transform/extensions": "latest",
"@gltf-transform/functions": "latest",
"draco3dgltf": "latest",
"meshoptimizer": "latest",
"sharp": "latest"

Technical Analysis

All runtime dependencies use npm's mutable latest distribution tag rather than reviewed, exact versions. Consequently, a new installation can retrieve package releases that were not available when the Skill was audited. Without an accompanying lockfile, installations are also non-reproducible and cannot reliably enforce previously reviewed dependency versions and integrity hashes.

Several dependencies are loaded directly by references/optimize-glb.mjs. Package installation may additionally execute npm lifecycle scripts. Therefore, compromise of an upstream package or its publishing account could introduce attacker-controlled code into the installation or optimization process.

This finding does not establish that any currently published dependency is malicious. It identifies an avoidable supply-chain exposure caused by automatically trusting future releases.

Attack Path

1. An attacker compromises an upstream dependency's maintainer account, publishing pipeline, or package distribution process.
2. A malicious release becomes the version referenced by the latest tag.
3. A user creates a Node.js project from references/package-template.json and runs an npm installation.
4. npm resolves the mutable tag to the malicious, previously unaudited release.
5. Attacker-controlled code executes through an installation lifecycle script or when the optimization script imports and invokes the dependency.
6. The code runs with the operating-system permissions of the user executing npm or the optimizer.

Impact Assessment

Suc ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every latest tag with an exact, reviewed version, without caret or tilde ranges. For example:

json

{
  "dependencies": {
    "@gltf-transform/core": "REVIEWED_EXACT_VERSION",
    "@gltf-transform/extensions": "REVIEWED_EXACT_VERSION",
    "@gltf-transform/functions": "REVIEWED_EXACT_VERSION",
    "draco3dgltf": "REVIEWED_EXACT_VERSION",
    "meshoptimizer": "REVIEWED_EXACT_VERSION",
    "sharp": "REVIEWED_EXACT_VERSION"
  }
}

2. Generate and commit package-lock.json so resolved transitive versions and integrity hashes are recorded.
3. Use npm ci in development and CI rather than allowing dependency resolution to change implicitly.
4. Review changelogs, provenance, maintainer changes, and lifecycle scripts before updating pinned versions.
5. Run vulnerability and dependency-policy checks in CI, while reviewing findings rather than applying unverified automatic upgrades.
6. Where operationally feasible, perform package installation and asset processing in a sandbox or least-privileged build environment with no unnecessary credentials.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents this skill as an offline asset optimization/preparation tool for GLB/GLTF models, with capabilities such as simplification, texture compression policy by texture slot, Draco compression, LOD generation, and manifest output. The supplied code does none of those transformations. Instead, it is a client-side Three.js loader helper that configures GLTFLoader with Draco decoding and optional KTX2 transcoder support, then loads already-produced LOD GLB files and combines them into a THREE.LOD container. While Draco and KTX2 are mentioned in both, the code only supports decoding/loading of assets that were already compressed elsewhere; it does not perform compression or optimization itself. This is a material description-behavior mismatch in primary purpose and advertised capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill body switches into Chinese for the primary operating instructions, which creates a language/locale constraint for users who may not have requested Chinese output. The file does not state that Chinese is optional, configurable, or limited to a specific region-specific use case.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comments and surrounding logic claim slot-specific KTX2 behavior such as ETC1S vs UASTC selection and color-space enforcement, but the actual textureCompress calls do not pass options that prove those guarantees are being applied. This creates a security-relevant integrity issue: downstream users may trust the generated assets and manifest as preserving expected texture fidelity or semantics when the encoder may silently use different defaults, leading to unsafe assumptions in automated pipelines.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest publishes slotCompressionMap values advertising per-slot KTX2 modes and color-space choices, but those values are copied from static configuration rather than derived from the actual output files. Consumers of the manifest may make loading, QA, or rendering decisions based on false metadata, causing integrity failures and broken assumptions across an automated asset pipeline.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code includes multiple natural-language comments and user-facing console output in Chinese, such as texture-processing messages and status text, without offering a language choice or documenting that the tool is intended only for a Chinese-speaking context. That creates a locale-policy concern because the skill implicitly fixes its language for operators without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JavaScript file contains natural-language comments and a user-facing console warning in Chinese only, including the warning emitted at L046-L049. Per the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.