The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to trigger its deterministic build pipeline (e.g., node scripts/build-and-export.mjs). These commands are standard for project automation and perform specific tasks such as geometry validation and file export within the user's project directory.
[EXTERNAL_DOWNLOADS]: The skill downloads the three library via NPM during setup (npm ci). This is a well-known, established graphics library from the official registry. No other external downloads from unknown or untrusted sources were detected.
[PROMPT_INJECTION]: The skill includes instructions to the agent to ensure model generation is deterministic and constrained by the provided build-contract.md. These instructions are defensive in nature, explicitly forbidding the use of dynamic imports, network APIs, or unauthorized system access within the generated model code.
[REMOTE_CODE_EXECUTION]: The skill executes model code provided by the user (or the agent). To mitigate risks, the system performs a static source scan (scripts/runtime/load-model-build.mjs) for forbidden patterns like require, eval, and network requests before importing the module. While it uses import(), it is gated by these validation steps and limited to local files.
[DATA_EXFILTRATION]: No data exfiltration patterns were detected. The skill operates entirely on local files within a user-defined task directory. The serve-viewer.mjs script starts a local HTTP server bound to 127.0.0.1 for visual review, which does not expose data to the network.

3d-model-generator-by-threejs