The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to execute a Python script (scripts/threejs_3d_asset.py) to perform its primary functions, including asset generation and validation. It also includes a probe command to check for the presence of the TRIPO_API_KEY environment variable in the shell environment.
[EXTERNAL_DOWNLOADS]: The Python script performs network operations to interact with the Tripo API (api.tripo3d.ai) and downloads generated 3D assets (GLB, FBX) and preview images to the local file system. These operations are consistent with the skill's stated purpose of 3D asset generation and prepare content for local Three.js integration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text prompts and image files which are then processed by the Tripo AI API. While this presents an attack surface where malicious instructions could be embedded in the input, the skill acts as a pass-through for generative tasks and does not demonstrate vulnerable interpolation or automated execution of data returned from the API beyond file storage.
Ingestion points: User prompts and local/remote image paths are ingested via the text, image, and character-pipeline commands in threejs_3d_asset.py.
Boundary markers: No specific delimiters or safety instructions are wrapped around the user-provided prompt before it is sent to the external API.
Capability inventory: The skill possesses network access (urllib.request) and file system write capabilities (Path.write_bytes) for asset management.
Sanitization: Input prompts are handled as string literals in JSON payloads, and images are uploaded via standard multipart form data.

threejs-3d-generator