add-scene-warmup

SUSPICIOUS: the stated purpose is coherent for a React Three Fiber/WebGPU warmup skill, and there is no direct evidence of credential theft or stealthy exfiltration in the visible text. However, the skill's effective implementation is fetched from an unverified `threenix` MCP server, which can supply both repository files and dependency-install instructions at runtime, creating a significant supply-chain and remote code insertion risk disproportionate to the limited transparency of the skill itself.