The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill guides the user to install official vendor packages @splinetool/react-spline and @splinetool/runtime and fetches the runtime library from the esm.sh CDN for vanilla JavaScript implementations.
[REMOTE_CODE_EXECUTION]: The skill uses the Spline runtime to load and process interactive scene data from the vendor's production servers (prod.spline.design). This is the intended functionality for rendering 3D content and utilizes the official vendor infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external 3D scene files, which constitutes a data ingestion surface.
Ingestion points: Scene data is loaded via the spline.load() method and the <Spline /> component in SKILL.md, the integration guides, and the interactive examples.
Boundary markers: Not explicitly defined in the implementation code; the skill assumes the data follows the vendor's .splinecode format.
Capability inventory: The exposed capabilities are restricted to the 3D environment (e.g., object transformation, camera control, and UI events like mouseDown). The skill does not exhibit file system access, network exfiltration of sensitive data, or shell command execution.
Sanitization: Parsing and validation of the external scene data are performed by the official @splinetool/runtime library.

spline-3d