The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides examples for configuring specialized asset loaders that fetch necessary libraries from external sources. Specifically, it references Draco decoders hosted on Google's gstatic.com and KTX2 transcoders from the jsdelivr.net CDN. These are well-known services and represent standard developer practices for Three.js applications.
[INDIRECT_PROMPT_INJECTION]: The skill describes methods for ingesting external data through various Three.js loaders (e.g., GLTFLoader, RGBELoader). While this provides an attack surface for untrusted data (such as malicious metadata in 3D models), the skill does not perform high-risk operations like dynamic code execution or network exfiltration using this data. The ingestion is handled by standard library parsers.
[SAFE]: No instances of prompt injection, unauthorized data access, persistence mechanisms, or obfuscation were found in the instructions or code snippets. The skill follows established Three.js development patterns.

threejs-loaders