threejs-game-director

SUSPICIOUS. The skill’s capabilities largely fit its stated purpose as a Three.js project orchestrator, but it expands trust to multiple sibling skills and asks the agent to run a local shell script that sources the user’s shell profile to inspect API-key availability. No direct malicious or covert exfiltration behavior is shown, but credential exposure and unverifiable downstream provider flows make the overall risk medium.