The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external URLs and captures console logs, page errors, and game diagnostics. A malicious game could output instructions designed to influence the agent's behavior when it reviews these artifacts.
Ingestion points: The scripts/inspect-threejs-canvas.mjs script navigates to a user-provided URL and captures console output (message.text()) and page errors (error.message).
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the captured logs or diagnostics.
Capability inventory: The skill performs shell command execution (node, npm, npx, playwright), file system writes (screenshots, JSON reports), and network operations via a headless browser.
Sanitization: No sanitization or filtering is applied to the captured browser logs before they are presented to the agent context.
[COMMAND_EXECUTION]: The instructions require the agent to execute several shell commands to perform its tasks, including installing dependencies, running the canvas inspector script, and executing Playwright test suites.
Evidence: node <this-skill-dir>/scripts/inspect-threejs-canvas.mjs, npm run build, npx playwright test.
[EXTERNAL_DOWNLOADS]: The skill relies on external Node.js dependencies and browser binaries that are downloaded during the setup phase.
Evidence: The scripts/inspect-threejs-canvas.mjs script imports @playwright/test and pngjs. Documentation mentions running npm install and npx playwright install chromium.

threejs-qa-release