Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cdbattags/ai --skill find-3d-assetsgit clone --depth 1 https://github.com/cdbattags/aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cdbattags/ai/find-3d-assets)<a href="https://agentmods.dev/skills/cdbattags/ai/find-3d-assets"><img src="https://agentmods.dev/badge/skills/cdbattags/ai/find-3d-assets/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cdbattags/ai/find-3d-assets"><img src="https://agentmods.dev/badge/skills/cdbattags/ai/find-3d-assets.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.05036 |
| Opus 5 | $0.00033 | $0.02518 |
| Sonnet 5 | $0.00013 | $0.01007 |
| Haiku 4.5 | $0.00007 | $0.00504 |
Grade C, and why
find-3d-assets scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /tmp/model.zip /tmp/model_tmp/ Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://api.sketchfab.com/v3/search?type=models&q=standing+desk&downloadable=true&sort_by=-likeCount&count=5" \ How it starts
The opening of the file, as written. The whole thing — 433 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Finding 3D Assets for Web Projects
Search Strategy
When looking for a specific 3D model, follow this priority order:
1. Check Local Models First
Look in modules/web-app/public/models/ — the model (or something close) might already exist.
See the Current Project Models table at the bottom.
2. Search Sketchfab (Largest Library, API Download)
Sketchfab is the primary source for high-quality downloadable 3D models. It has API-based download
which makes it the most automatable option when the user has a SKETCHFAB_API_TOKEN.
Finding models — web search:
site:sketchfab.com [object name] low poly downloadable free
sketchfab [object name] CC0 OR CC-BY download
Finding models — direct Sketchfab search URL:
https://sketchfab.com/search?q=[keyword]&downloadable=true&sort_by=-likeCount
Finding models — Sketchfab Search API:
# Search without auth (public models)
curl -s "https://api.sketchfab.com/v3/search?type=models&q=standing+desk&downloadable=true&sort_by=-likeCount&count=5" \
| python3 -c "
import sys, json
data = json.load(sys.stdin)
for r in data.get('results', []):
print(f\"{r['name']} by {r['user']['displayName']} — {r['faceCount']} tris — {r['license']['label']}\"
f\" https://sketchfab.com/3d-models/{r['slug']}-{r['uid']}\")
"
Filters to use when searching:
downloadable=true— only models with download enabledsort_by=-likeCount— most popular first (usually highest quality)license=byfor CC-BY,license=cc0for CC0max_face_count=20000— keep it web-friendly
Sketchfab Download Workflow (Automated)
Requires: SKETCHFAB_API_TOKEN environment variable (stored in .env, loaded by direnv).
Get one at: https://sketchfab.com/settings/password → "API Token" section.
MODEL_ID="65a7f4b06a5f4954a0d43eb8812dd165" # hex ID from the model URL
OUTPUT="standingDesk.glb" # target filename
# Step 1 — Get signed download URLs (expires in 5 min)
DOWNLOAD_JSON=$(curl -s \
-H "Authorization: Token $SKETCHFAB_API_TOKEN" \
"https://api.sketchfab.com/v3/models/$MODEL_ID/download")
# Step 2 — Extract the GLB URL (preferred) or fall back to GLTF zip
GLB_URL=$(echo "$DOWNLOAD_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('glb',{}).get('url',''))")
GLTF_URL=$(echo "$DOWNLOAD_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('gltf',{}).get('url',''))")
if [ -n "$GLB_URL" ]; then
# Direct GLB — no conversion needed
curl -L -o "/tmp/${OUTPUT}" "$GLB_URL"
else
# GLTF zip — download, unzip, convert
curl -L -o /tmp/model.zip "$GLTF_URL"
unzip -o /tmp/model.zip -d /tmp/model_tmp/
npx gltf-pipeline -i /tmp/model_tmp/scene.gltf -o "/tmp/${OUTPUT}"
rm -rf /tmp/model.zip /tmp/model_tmp/
fi
# Step 3 — Optimize (MANDATORY — see "Post-Download Optimization" section)
# Sketchfab GLBs are typically 5-30MB; this pipeline gets them to 100-500KB.
npx gltf-transform resize "/tmp/${OUTPUT}" /tmp/opt-s1.glb --width 256 --height 256
npx gltf-transform simplify /tmp/opt-s1.glb /tmp/opt-s2.glb --ratio 0.05 --error 0.02
npx gltf-transform webp /tmp/opt-s2.glb /tmp/opt-s3.glb
npx gltf-transform prune /tmp/opt-s3.glb /tmp/opt-s4.glb
npx gltf-transform draco /tmp/opt-s4.glb "modules/web-app/public/models/${OUTPUT}"
rm -f /tmp/opt-s*.glb "/tmp/${OUTPUT}"
# Step 4 — Generate gzip sidecar for nginx gzip_static
node -e "
const fs=require('fs'),zlib=require('zlib');
const p='modules/web-app/public/models/${OUTPUT}';
const d=fs.readFileSync(p);
fs.writeFileSync(p+'.gz',zlib.gzipSync(d,{level:9}));
console.log('${OUTPUT}:',(d.length/1024).toFixed(0)+'KB →',(fs.statSync(p+'.gz').size/1024).toFixed(0)+'KB gzipped');
"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 433 lines · 66 tokens per session scan C acca9d23823d
find-3d-assets is a skill published in the GitHub repository cdbattags/ai (4 stars, last pushed 6mo ago), licensed MIT. It adds 66 tokens to every session and 5,036 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
godot-scene-plan
Plan the Godot scene and node structure for a 2D or 3D game feature before any GDScript is written: the scene tree, node types and responsibilities, autoloads (singletons), signal wiring, the input map, and the resources and sub-scenes to create. Produces GODOTSCENEPLAN.md, a design-time plan an MCP-driven editor or a…
builders
Skill for the Builders area of bloxforge. 96 symbols across 19 files.
handlers
Skill for the Handlers area of bloxforge. 208 symbols across 15 files.
modules
Skill for the Modules area of bloxforge. 118 symbols across 14 files.
rojo
Skill for the Rojo area of bloxforge. 95 symbols across 13 files.
godot-runtime-verify
Verify a built Godot 2D or 3D scene at runtime: run the scene (press-play or headless), read the captured debugger output, classify any runtime errors against a Godot-specific taxonomy, and decide a PASS/FAIL runtime gate for the slice's acceptance behavior. The run's real output IS the Layer-1 runtime evidence…