The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected in the analyzed files. The code implements standard 3D application logic using reputable libraries (Three.js and GSAP).
[EXTERNAL_DOWNLOADS]: The ModelManager class in model-manager.ts fetches the Draco decoder from Google's gstatic.com CDN. This is a standard practice for loading compressed 3D models and uses a well-known, trusted service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from URL query parameters (window.location.search) in state-machine.ts to restore product configuration state.
Ingestion points: The readFromURL method parses URL parameters.
Boundary markers: Values are explicitly checked against the config.dimensions object to ensure only predefined option IDs are accepted.
Capability inventory: The skill performs material swaps and camera movements but lacks capabilities for arbitrary command execution, file writing, or unauthorized network requests.
Sanitization: Strict validation against a static configuration object effectively sanitizes the input, preventing external data from executing unintended actions.
[DATA_EXPOSURE]: The skill does not access sensitive local file paths (like .ssh or .aws) or hardcode credentials. It uses standard web APIs for state persistence in the browser environment.

three-configurator-product