The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to install the vendor's CLI tool by piping remote scripts directly to shell interpreters.
Evidence: curl -fsSL https://d.officecli.ai/install.sh | bash (Linux/macOS) and irm https://d.officecli.ai/install.ps1 | iex (Windows).
While originating from the vendor's infrastructure, this installation method is a high-risk pattern that executes remote code without prior local inspection.
[EXTERNAL_DOWNLOADS]: The skill interacts with multiple external services to discover and download 3D assets.
Evidence: Fetches models and search results from Sketchfab, Poly Pizza, and the Khronos Group's GitHub repository.
These sources are well-known in the 3D community but represent runtime dependencies on external content.
[INDIRECT_PROMPT_INJECTION]: The skill queries third-party APIs (Sketchfab and Poly Pizza) for model metadata and presents the results to the agent and user.
Ingestion points: Search result data from api.sketchfab.com and poly.pizza.
Boundary markers: None; data is interpolated into text output via a Python script.
Capability inventory: The agent has capabilities for command execution, network access, and file system modification.
Sanitization: No sanitization or validation of the API-provided strings (e.g., model names or descriptions) is performed before presentation.
[COMMAND_EXECUTION]: The skill automates presentation building by executing several local commands.
Evidence: Frequent use of officecli for PPTX manipulation and curl for asset retrieval.

morph-ppt-3d