{"data":{"skill":{"slug":"heygen-com-three","name":"three","icon":"📦","repo":"https://github.com/heygen-com/hyperframes/tree/main/skills/three/","status":"approved","author":"heygen-com","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"b2720681-a627-451e-ad95-e89331a650ee","skill_id":"2e8ea154-65ec-47c4-a997-dafa762bd365","version":6,"content_hash":"v3:0519034dad657fb1f7706e0550e962beeda73fdf:12dd949a36e878fae99aedee3b22de2fe11be32598970166c7c171a223a8fde1:dbdc93492e7e7386bbde43aebd9ede84a39398b0c1a271437fc073cbce048fca:736b696c6c732f68657967656e2d636f6d2f7468726565:7d91d6d085a8799b30f365f6d2e26020","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are Markdown backticks, code fences, API names, or reference links that do not execute commands. The only confirmed issue is a sample Three.js import from a third-party CDN, which is a low-severity supply-chain dependency.","remediation":[{"issue":"The browser example imports Three.js from a third-party CDN.","severity":"low","suggestion":"Prefer a local package-managed import or document integrity and availability expectations for the CDN dependency."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":56,"line_start":22},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":64,"line_start":58},{"file":"SKILL.md","line_end":70,"line_start":64},{"file":"SKILL.md","line_end":75,"line_start":70},{"file":"SKILL.md","line_end":77,"line_start":75},{"file":"SKILL.md","line_end":82,"line_start":77},{"file":"SKILL.md","line_end":87,"line_start":82},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":100,"line_start":97},{"file":"SKILL.md","line_end":104,"line_start":100},{"file":"SKILL.md","line_end":105,"line_start":104},{"file":"SKILL.md","line_end":106,"line_start":105}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":25,"line_start":25}],"confidence":0.72,"description":"import * as THREE from \"https://cdn.jsdelivr.net/npm/three@0.181.2/+esm\";","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The example imports Three.js from jsdelivr, which creates a third-party code dependency at runtime. The version is pinned, so the risk is limited."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":107,"audit_model":"codex","audited_at":"2026-07-09T12:06:52.389+00:00","created_at":"2026-07-17T17:07:20.991912+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"HyperFrames supports Three.js through its `three` runtime adapter. The adapter does not own your sce","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Listen for the `hf-seek` event and render exactly that time.","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Avoid `requestAnimationFrame` or `renderer.setAnimationLoop` as the source of truth for render-cri","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The adapter sets `window.__hfThreeTime` and dispatches `new CustomEvent(\"hf-seek\", { detail: { time ","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":56,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":58,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```css","category":"external_commands","line_end":64,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":70,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":75,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":77,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If several mixers exist, seek all of them from the same `time`.","category":"external_commands","line_end":82,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Camera moves derived from `time`.","category":"external_commands","line_end":87,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Using `Date.now()`, `performance.now()`, or clock deltas to update scene state.","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":100,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":104,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- HyperFrames adapter source: `packages/core/src/runtime/adapters/three.ts`.","category":"external_commands","line_end":105,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Three.js `WebGLRenderer` docs: https://threejs.org/docs/pages/WebGLRenderer.html","category":"external_commands","line_end":106,"severity":"medium","line_start":105},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"import * as THREE from \"https://cdn.jsdelivr.net/npm/three@0.181.2/+esm\";","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:105:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Three.js `WebGLRenderer` docs: https://threejs.org/docs/pages/WebGLRenderer.html","category":"network","line_end":105,"severity":"low","line_start":105},{"id":"network:SKILL.md:106:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Three.js `AnimationMixer.setTime()` docs: https://threejs.org/docs/pages/AnimationMixer.html","category":"network","line_end":106,"severity":"low","line_start":106},{"id":"blocker:SKILL.md:16:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid `requestAnimationFrame` or `renderer.setAnimationLoop` as the source of truth for render-cri","category":"blocker","line_end":16,"severity":"low","line_start":16},{"id":"blocker:SKILL.md:85:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"## Avoid","category":"blocker","line_end":87,"severity":"low","line_start":85}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"The backticks mark the adapter name in prose and do not invoke a shell. No command execution or user-controlled input appears here.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"The backticks mark the hf-seek event name in documentation. This is prose guidance, not executable shell or Ruby code.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The backticks mark browser API names in an avoidance note. They are not shell execution syntax in this Markdown context.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The backticks wrap an inline JavaScript event example in documentation. It describes browser state and does not execute commands.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"This is an HTML code fence for a Three.js example. It contains browser rendering code, not Ruby backtick command execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This closes a Markdown code fence. It has no executable shell content and cannot run during skill loading.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"This opens a CSS code fence for styling a canvas. It is documentation formatting, not command execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"This closes a Markdown code fence. It is not executable code and carries no shell invocation.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"This opens a JavaScript code fence for AnimationMixer seeking. The sample calls render functions, not external commands.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"This closes a Markdown code fence. It does not run commands or expose a command injection path.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The backticks mark the time variable in prose. It is documentation text and not shell syntax.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The backticks mark a time variable in a good-use list. No external process or shell invocation is present.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks mark browser timing APIs in an avoidance list. This is safe documentation context, not system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The fenced bash example documents HyperFrames lint and validation commands. It does not execute automatically during skill use.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"This closes the bash code fence before reference links. The fence marker itself is not a command execution sink.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The backticks mark a repository file path in credits. This is a reference, not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"The backticks mark Three.js API names in a documentation link. The line does not invoke Ruby or shell commands.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The example imports Three.js from jsdelivr, which creates a third-party code dependency at runtime. The version is pinned, so the risk is limited.","verdict":"confirmed","severity":"low","confidence":0.72},{"id":"network:SKILL.md:105:hardcoded-url","reason":"The URL points to official Three.js WebGLRenderer documentation. It is a reference link and is not fetched by the skill.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:106:hardcoded-url","reason":"The URL points to official Three.js AnimationMixer documentation. It is a reference link and is not a runtime network request.","verdict":"false_positive","confidence":0.88},{"id":"blocker:SKILL.md:16:system-reconnaissance","reason":"The line advises against free-running render loops for deterministic output. It does not inspect the host system or gather environment data.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:85:system-reconnaissance","reason":"The Avoid section lists rendering practices to avoid. It has no reconnaissance behavior or instructions to query system state.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[],"subject_marketplace_commit_sha":"0519034dad657fb1f7706e0550e962beeda73fdf","subject_content_hash":"12dd949a36e878fae99aedee3b22de2fe11be32598970166c7c171a223a8fde1","subject_tree_hash":"dbdc93492e7e7386bbde43aebd9ede84a39398b0c1a271437fc073cbce048fca","subject_plugin_path":"skills/heygen-com/three","audit_payload_hash":"7d91d6d085a8799b30f365f6d2e26020","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"0519034dad657fb1f7706e0550e962beeda73fdf","contentHash":"12dd949a36e878fae99aedee3b22de2fe11be32598970166c7c171a223a8fde1","treeHash":"dbdc93492e7e7386bbde43aebd9ede84a39398b0c1a271437fc073cbce048fca","pluginPath":"skills/heygen-com/three","auditPayloadHash":"7d91d6d085a8799b30f365f6d2e26020"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}