The Agent Skills Directory

[PROMPT_INJECTION]: The instructions do not contain any patterns designed to bypass agent safety filters, override system instructions, or extract system prompts. The language is purely technical and instructional.
[DATA_EXFILTRATION]: No hardcoded credentials, sensitive file paths (like .ssh or .aws), or network calls to external, non-whitelisted domains were found. Asset loading is restricted to local paths like /models/ and /textures/.
[REMOTE_CODE_EXECUTION]: The skill suggests the use of npx gltfjsx, which is a well-known, legitimate development tool within the Three.js community for generating JSX components from 3D models. No unauthorized or suspicious remote script execution patterns (e.g., curl piped to bash) were detected.
[OBFUSCATION]: The content is entirely in plain text. No Base64 encoding, zero-width characters, homoglyphs, or other techniques to hide intent were found.
[DYNAMIC_EXECUTION]: The code snippets provided are standard JavaScript and React Three Fiber recipes. They do not use unsafe functions like eval() or exec() for runtime code generation from untrusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill manages external 3D assets (GLB and textures), which is a common pattern for configurator tools. It uses standard Three.js loaders and does not interpolate external data into instructions in an unsafe manner.

threejs-model-customize