The Agent Skills Directory

[SAFE]: The skill is entirely documentation-based, providing instructions and templates for using a specific developer SDK. No malicious instructions, obfuscation, or unauthorized access patterns were detected.
[EXTERNAL_DOWNLOADS]: References to external resources, such as the @xrift/sdk npm package and the GitHub repository WebXR-JP/xrift-sdk, are legitimate and consistent with the skill's stated purpose of documenting the SDK. These resources belong to the author's own infrastructure.
[DATA_EXFILTRATION]: The documented upload flow correctly identifies api.xrift.net as the platform's API endpoint. The skill explicitly advises users to store API tokens in environment variables rather than hardcoding them, which is a recommended security practice.
[COMMAND_EXECUTION]: The provided code templates use standard file system operations (fs.readFile) and network requests (fetch) required for the SDK to function. All file access and network operations are scoped to the intended task of uploading 3D assets to the XRift platform.

xrift-sdk