The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the variable encodedHtml. This string encodes the entire structure, styling, and logic of the demo page, effectively hiding the implementation details from static inspection.
[DYNAMIC_EXECUTION]: The script within demo/index.html decodes the encodedHtml Base64 string at runtime and dynamically injects the result into the srcdoc attribute of an iframe. This method of executing decoded strings bypasses standard static code review processes.
[EXTERNAL_DOWNLOADS]: The demo environment fetches several JavaScript runtime libraries and image assets. According to the demo/source.json manifest, these resources are sourced from well-known services including Cloudflare (for GSAP libraries), Iconify (for icons), and Supabase (for image storage).
[INDIRECT_PROMPT_INJECTION]: The skill instructions and demo prompts create an attack surface for indirect injection by processing external data and user-defined options.
Ingestion points: The initWebGL3DObject function in SKILL.md accepts an options object for material and lighting properties. demo/PROMPT.md directs the agent to fetch reference content from external URLs on neuform.ai.
Boundary markers: None detected; instructions do not include delimiters or warnings to ignore embedded commands in the fetched reference content.
Capability inventory: The skill uses Three.js for WebGL rendering and demo/index.html utilizes DOM manipulation and iframe injection via srcdoc.
Sanitization: No sanitization or validation of the options object or fetched external content was observed.

webgl-3d-object