The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute packages using npx @gltf-transform/cli and npx gltfjsx. These are standard tools in the 3D web development ecosystem.
Evidence: Found in SKILL.md shell commands and the GitHub Actions pipeline section.
[EXTERNAL_DOWNLOADS]: The runtime configuration references external WASM decoders and transcoders hosted on well-known and trusted CDNs.
Evidence: https://www.gstatic.com/draco/versioned/decoders/1.5.7/ (Google) and https://cdn.jsdelivr.net/npm/three@0.169.0/examples/jsm/libs/basis/ (jsDelivr).
[COMMAND_EXECUTION]: The skill provides numerous shell commands for asset optimization, including geometry compression, texture resizing, and mesh deduplication.
Evidence: Commands such as gltf-transform optimize, weld, instance, and gltfpack are documented for build-time use.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external 3D model files (.glb, .gltf), which constitutes an attack surface for indirect prompt injection if the processing tools have vulnerabilities, though this is a standard use case for asset pipelines.
Ingestion points: Local .glb files processed by gltf-transform (documented in SKILL.md).
Boundary markers: Not applicable for binary asset processing.
Capability inventory: The skill uses npx for command execution and local file read/write operations.
Sanitization: The skill relies on the underlying libraries (gltf-transform, gltfpack) to handle binary parsing safely.

three-gltf-pipeline-optimization