The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard package management commands (npm create vite, npm install) to scaffold the project and install dependencies.
Evidence: npm create vite@latest <project-name> -- --template vanilla-ts and npm install for various ThatOpen and Three.js packages in SKILL.md.
[SAFE]: The skill implements security best practices by requiring Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers in the Vite configuration to enable cross-origin isolation for WebAssembly (WASM) operations.
Evidence: Step 3 in SKILL.md and references/examples.md contains middleware logic to set COOP and COEP headers.
[INDIRECT_PROMPT_INJECTION]: The skill scaffolds an application that ingests external IFC (Industry Foundation Classes) files, which represents a potential indirect injection surface if the parser or viewer were vulnerable to maliciously crafted files.
Ingestion points: The fileInput element in src/main.ts (found in references/examples.md) reads external .ifc files.
Boundary markers: The skill instructions do not explicitly provide delimiters for the processed data, as it is handled as binary content for a 3D engine.
Capability inventory: The generated code creates a local development environment and provides file-reading capabilities.
Sanitization: Data is converted to Uint8Array before being passed to the ifcLoader, which is a standard method for binary data handling.
[SAFE]: The skill includes explicit instructions for memory management and resource disposal, reducing the risk of application instability or memory-related denial of service.
Evidence: Step 11 in references/examples.md and AP-012 in references/anti-patterns.md describe the use of components.dispose() during the beforeunload event.

thatopen-agents-viewer-builder