The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous code patterns that utilize subprocess.run to execute external command-line tools for 3D processing, such as Blender, toktx, cwebp, and instant-meshes. While using argument lists for subprocess calls mitigates shell injection, the execution of local binaries remains a privileged operation.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloads from several well-known and legitimate 3D asset providers and open repositories. These include Sketchfab (sketchfab.com), Objaverse (HuggingFace), Poly Pizza (polypizza.xyz), and the Smithsonian 3D API (3d-api.si.edu).
[DYNAMIC_EXECUTION]: In references/game-pipeline.md, the run_pipeline function dynamically generates a Blender Python script using f-strings to interpolate configuration values such as asset names and file paths. This script is then executed via the Blender CLI, presenting a risk of script injection if the interpolated variables contain malicious Python code.
[CREDENTIALS_SAFE]: The skill correctly instructs the agent to handle API keys and tokens (e.g., MESHY_API_KEY, TRIPO_API_KEY, SKETCHFAB_API_TOKEN) using environment variables, avoiding the risk of hardcoded secrets.
[INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided prompts and parameters that are subsequently used to generate API calls and local scripts. It lacks explicit input validation or sanitization layers to prevent malicious strings from influencing the generated code or command-line arguments.

clay