The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions recommend installation via npx threejs-devtools-mcp, which downloads and executes the package from the npm registry at runtime.
[COMMAND_EXECUTION]: The installation process involves executing shell commands to add the MCP server to various agent configurations (Claude, Cursor, Windsurf, etc.).
[DYNAMIC_EXECUTION]: The skill injects a WebSocket bridge into the browser's JavaScript context using the Chrome DevTools Protocol to enable real-time communication with the Three.js scene. It also includes tools like update_shader and generate_react_component that involve dynamic code updates or generation.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes data from external web applications.
Ingestion points: Data is ingested through tools like get_scene_tree, get_object_details, and get_shaders which read object names, hierarchy, and shader source code.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the ingested scene data.
Capability inventory: The skill has the capability to modify the scene (update_material, update_object_transform), update shaders (update_shader), and generate code (generate_react_component).
Sanitization: The instructions do not specify any sanitization or filtering of the content retrieved from the Three.js scene before it is presented to the agent.

threejs-devtools-mcp