The Agent Skills Directory

[SAFE]: A comprehensive security audit was conducted on all 67 files within the skill. The analysis confirms that the skill is a legitimate creative tool ported by Nous Research. The implementation follows best practices for binary data handling and local process automation.
[COMMAND_EXECUTION]: The scripts capture.mjs, drive.mjs, and lines.mjs use node:child_process to spawn a headless Chrome/Chromium instance. This is required for rendering SVG and WebGL content into images and performing geometric verification. The spawned processes are controlled via local WebSocket connections to a dynamically assigned port on 127.0.0.1.
[DYNAMIC_EXECUTION]: The browser automation scripts use Runtime.evaluate to interact with the rendered figures (e.g., simulating clicks, reading readout text). This execution is entirely scoped to the browser sandbox and the local HTML files generated by the user's build process.
[DATA_EXFILTRATION]: No unauthorized network activity or sensitive data access was identified. The skill does not access credentials, SSH keys, or environment files. Communication is strictly confined to the local machine for browser control.
[OBFUSCATION]: The 3D engine (turn.mjs and turn-build.mjs) uses Base64 encoding to store and transmit packed binary geometric data (such as separating planes). This is a standard optimization for transmission size and is not used to hide malicious instructions or payloads.
[EXTERNAL_DOWNLOADS]: The skill is self-contained and uses Node.js built-in modules. It does not perform runtime package installation or fetch remote executable scripts.
[PROMPT_INJECTION]: The instructions in SKILL.md are technical and functional, providing clear guidance on workflow, sizing, and geometric constraints without any patterns indicative of behavioral override or safety bypass attempts.

anatomy