threejs-object-sculptor-codex-plugin

SUSPICIOUS: the skill’s stated purpose is coherent with its local modeling workflow, but the installation path is not trustworthy because it depends on an unspecified, unverifiable git repository with no pinned revision or release verification. No clear credential theft or malicious data exfiltration is shown in the default workflow, so this is high supply-chain risk rather than confirmed malware.