The Agent Skills Directory

[SAFE]: The skill consists of documentation and code examples for Three.js (r186). The instructions and code snippets follow standard development patterns for 3D graphics programming and do not contain any malicious instructions or hidden payloads.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates the ingestion of external 3D assets using GLTFLoader.loadAsync("model.glb"). This is a standard vulnerability surface for 3D applications where untrusted model files could potentially contain malicious metadata or structures intended to influence an agent.
Ingestion points: SKILL.md (runtime loading of .glb files via GLTFLoader).
Boundary markers: None specified; behavior relies on the standard Three.js loader implementation.
Capability inventory: The skill manipulates the scene graph, poses bones, and updates morph target influences via the AnimationMixer and SkeletonUtils APIs. It does not perform network exfiltration or file system modifications.
Sanitization: No specific sanitization or validation of the loaded model's internal data is mentioned beyond standard library usage.
[EXTERNAL_DOWNLOADS]: The skill references the three package and its official addons (GLTFLoader, SkeletonUtils) via standard JavaScript imports. These are well-known, trusted resources in the web development ecosystem.

threejs-animation