The Agent Skills Directory

[SAFE]: The skill provides legitimate resources and tools for building 3D web applications. The provided Python scripts (mesh_builder.py and scene_generator.py) are helper utilities for generating boilerplate JavaScript/TypeScript code and do not exhibit any dangerous behaviors or excessive permission requests.
[INDIRECT_PROMPT_INJECTION]: The skill utilizes external asset loading capabilities (e.g., loading .glb models and textures from remote URLs), which is an attack surface for indirect prompt injection.
Ingestion points: BABYLON.SceneLoader.ImportMeshAsync and BABYLON.Texture calls in assets/examples/README.md, SKILL.md, and assets/starter_babylon/src/main.js which ingest external asset metadata into the engine.
Boundary markers: Absent.
Capability inventory: File system writes for code generation (via scripts/mesh_builder.py and scripts/scene_generator.py) and network operations for remote asset loading.
Sanitization: Absent.
[COMMAND_EXECUTION]: The Python scripts (mesh_builder.py, scene_generator.py) take user-provided parameters to generate code strings which are then written to disk. While these scripts do not sanitize inputs for generated string literals, this behavior is typical for boilerplate generation tools and does not constitute an exploitable vulnerability within the context of this skill.

babylonjs-engine