The Agent Skills Directory

[SAFE]: No security issues were detected. The skill implements best practices for Three.js QA, including deterministic testing and renderer auditing.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through its canvas and page inspection features. Evidence chain:
Ingestion points: The inspect-threejs-canvas.mjs script navigates to user-specified URLs and extracts data from the browser's global scope (window.__THREE_APP_DIAGNOSTICS__, window.__THREE_GAME_DIAGNOSTICS__) and console logs.
Boundary markers: There are no explicit delimiters or instructions to disregard potential commands embedded within the captured diagnostic data.
Capability inventory: The skill uses Playwright for browser interaction and performs local filesystem writes to save JSON reports and PNG screenshots.
Sanitization: Data retrieved from the browser is included in reports without sanitization, which is typical for developer-focused QA tooling.
[REMOTE_CODE_EXECUTION]: The script dynamically loads dependencies (@playwright/test and pngjs) from the project's local directory using createRequire. This is a standard and safe implementation for local CLI tools to leverage a repository's specific dependency versions.

threejs-qa-release