The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a bundled Python script scripts/inspect_gltf.py for performing structural and dependency preflight checks on 3D assets. The associated test suite, tests/test_inspect_gltf.py, also utilizes subprocess.run to verify the utility's behavior in a controlled environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external 3D asset data (glTF/GLB files), which could potentially contain malicious content intended to influence agent behavior or exploit the processing environment. However, the provided validation script explicitly implements security best practices to mitigate these risks:
Ingestion points: Path to .gltf or .glb files and their internal URI references for buffers and images.
Boundary markers: The script performs structural validation to ensure files conform to the glTF 2.0 specification.
Capability inventory: The script is limited to reading files, parsing JSON, and estimating data sizes; it does not perform network operations or write files.
Sanitization: The safe_external_path function effectively prevents path traversal attacks by validating that all resolved resource paths remain within the designated root directory using Path.relative_to checks. It also enforces limits on the size of base64-encoded data URIs.

3d-asset-production