The Agent Skills Directory

[OBFUSCATION]: The file demo/secret-pathways-assets/fonts.css contains several large blocks of Base64 encoded data. Analysis confirms these are standard data:font/woff2;base64 URIs used to embed the 'Onest' and 'Wordmark' font families directly into the stylesheet. This is a common and benign web development practice and does not represent a security risk.
[REMOTE_CODE_EXECUTION]: The skill mentions an external public GitHub repository (github.com/oso95/scroll-world) at a specific commit (71cc36d) as a structural reference for intake and QA processes. The instructions specifically warn the agent not to use its renderer (which is video-based) and instead focus on real geometry, ensuring the agent remains within the intended Three.js scope. No instructions to download or execute remote scripts are present.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-supplied story beats, art direction, and world subjects to generate a 3D experience.
Ingestion points: User-provided project requirements and reference materials.
Boundary markers: The skill uses structured 'world bibles' and 'scene ledgers' to organize data, which helps maintain clear boundaries between instructional logic and user-provided data.
Capability inventory: The skill generates Three.js code and configuration ledgers; it does not perform subprocess calls or sensitive file operations.
Sanitization: The instructions emphasize using measured details and structured data (JSON/JS objects) rather than free-text adjectives, which reduces the surface for injection.

build-threejs-scroll-worlds