The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the three.js library from the official NPM registry at runtime if it is not found locally.
Evidence: scripts/render_preview.mjs fetches the tarball from registry.npmjs.org and verifies its integrity using a hardcoded SHA-512 hash.
[COMMAND_EXECUTION]: The skill uses terminal commands to process 3D assets and manage asynchronous generation tasks.
Evidence: SKILL.md and references/messaging.md instruct the agent to use the terminal tool to run sleep commands for background polling and to execute local scripts such as glb_stats.py, blender_handoff.py, and render_preview.mjs.
[DYNAMIC_EXECUTION]: The skill performs dynamic code execution to enable 3D rendering and model verification.
Evidence: scripts/render_preview.mjs injects and executes JavaScript strings inside a headless Chromium instance via Chrome DevTools Protocol (CDP) to render previews. scripts/blender_handoff.py uses subprocess.run to call the Blender Python interpreter for asset validation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data, including 3D model files and task metadata from the Meshy AI service, which constitutes a vulnerability surface.
Ingestion points: Reads task status, metadata, and model URLs from the Meshy API; processes .glb and .fbx files locally.
Boundary markers: Instructions advise the agent to verify the actual contents of the files (e.g., checking for skinned meshes or animation clips) rather than relying solely on task status reports.
Capability inventory: Includes shell access via terminal, file system operations, and network downloads.
Sanitization: Relies on standard parsing libraries like three.js loaders and json.loads to process external inputs.

meshy-3d