The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the Spark library from sparkjs.dev and the Three.js library from jsdelivr. These are legitimate vendor and well-known service resources, respectively.
[COMMAND_EXECUTION]: Documentation provides standard installation commands using npm for the @sparkjsdev/spark package and three library.
[INDIRECT_PROMPT_INJECTION]: The skill processes external 3D capture files (e.g., .spz, .ply, .splat).
Ingestion points: Capture URLs passed to the SplatMesh constructor and file formats listed in SKILL.md.
Boundary markers: None present for the binary capture data.
Capability inventory: Rendering via WebGL, scene graph manipulation, and raycasting. No file system write or network exfiltration capabilities are identified.
Sanitization: None mentioned, though binary 3D data poses a negligible risk for prompt injection compared to text-based formats.

threejs-splats