The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides examples for configuring loaders that fetch specialized library decoders from well-known and trusted sources.
Evidence: dracoLoader.setDecoderPath("https://www.gstatic.com/draco/versioned/decoders/1.5.6/"); (Google's gstatic domain for Draco decoders).
Evidence: ktx2Loader.setTranscoderPath("https://cdn.jsdelivr.net/npm/three@0.160.0/examples/jsm/libs/basis/"); (jsDelivr CDN for Basis/KTX2 transcoders).
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external 3D asset files (GLTF/GLB) which may contain attacker-controlled metadata such as userData or animation clip names.
Ingestion points: GLTFLoader.load, loader.parse, and fetch operations within asset management classes.
Boundary markers: None present in the documentation examples.
Capability inventory: The skill demonstrates accessing gltf.userData and gltf.animations via standard library methods.
Sanitization: Not implemented in the instructional examples, which is standard for library-usage documentation.

threejs-loaders