Borrowing it
Nothing to install: this file belongs to dcc-mcp/dcc-mcp-3dsmax. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dcc-mcp/dcc-mcp-3dsmax/main/.agents/skills/vx-best-practices/SKILL.mdgit clone --depth 1 https://github.com/dcc-mcp/dcc-mcp-3dsmaxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dcc-mcp/dcc-mcp-3dsmax/vx-best-practices)<a href="https://agentmods.dev/skills/dcc-mcp/dcc-mcp-3dsmax/vx-best-practices"><img src="https://agentmods.dev/badge/skills/dcc-mcp/dcc-mcp-3dsmax/vx-best-practices/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dcc-mcp/dcc-mcp-3dsmax/vx-best-practices"><img src="https://agentmods.dev/badge/skills/dcc-mcp/dcc-mcp-3dsmax/vx-best-practices.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.03443 |
| Opus 5 | $0.00015 | $0.01722 |
| Sonnet 5 | $0.00006 | $0.00689 |
| Haiku 4.5 | $0.00003 | $0.00344 |
Grade D, and why
vx-best-practices scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
# ❌ sudo vx install node Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf ~/.nvm How it starts
The opening of the file, as written. The whole thing — 573 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VX Best Practices
Golden rule: Always prefix tool commands with
vxin vx-managed projects. Usevx.tomlfor project-level tool versions, commitvx.lockfor reproducibility, prefer templates over custom code when creating providers, and prefer structured or compact output before reading large logs.
General Principles
1. Always Use vx Prefix
In vx-managed projects, always prefix tool commands with vx:
# ✅ Correct
vx npm install
vx cargo build
vx just test
# ❌ Wrong (might use system tools)
npm install
cargo build
just test
2. Prefer Project-Level Configuration
Use vx.toml to ensure consistency across team members:
# ✅ Correct - defined in vx.toml
vx sync
# ❌ Wrong - manual installation
vx install node@22
3. Commit Lock Files
Always commit vx.lock to ensure reproducible builds:
vx git add vx.lock
vx git commit -m "chore: update dependencies"
4. Keep Agent Work Small and Observable
When an AI agent uses vx, optimize for correctness, speed, judgment, and token efficiency:
- Read enough surrounding code to understand the local pattern, then stop exploring.
- Prefer targeted searches, focused file sections, scoped diffs, selected JSON fields, and capped logs.
- Make the smallest maintainable change that solves the request.
- Reuse existing project helpers before creating new abstractions.
- Avoid single-use wrappers, speculative architecture, and unrelated cleanup.
- Validate according to risk: focused tests for narrow changes, broader checks for shared behavior.
- Preserve evidence from the actual command, CI job, or runtime surface when debugging.
For large or unknown output, scope first and filter through vx-managed tools:
vx rg -n -m 20 "SearchTerm" src
vx git diff --stat
vx git diff --name-only origin/main...HEAD
vx gh pr view 123 --json title,state,files
vx gh run view 456 --json status,conclusion,jobs --jq '.jobs[] | {name,conclusion}'
vx gh run view 456 --log | vx rg -n -m 50 "error|failed|panic|Traceback|FAILED"
vx --compact gh run view 456 --log
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 573 lines · 31 tokens per session scan D 2a8877ec4944
vx-best-practices is a skill published in the GitHub repository dcc-mcp/dcc-mcp-3dsmax (4 stars, last pushed today), licensed MIT. It adds 31 tokens to every session and 3,443 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
maya-render
Pipeline stage — render globals, final-frame rendering, and viewport capture: configure render settings, query them, render frames, capture playblasts. Use for producing final or preview imagery. Not for modeling (maya-mesh-ops), animation editing (maya-animation), generic file import/export (maya-geometry), or render…
maya-scripting
Bootstrap stage — escape hatch for Maya work that has no packaged skill yet. Agents should prefer searchskills / dcccapabilitymanifest → loadskill → typed tools (inputSchema + annotations) from domain skills; use executepython or executemel only when no skill matches, for bulk in-process loops, or for API…
dcc-mcp-maya-setup
Set up dcc-mcp-maya for an agent or operator: install Maya Python dependencies with mayapy, generate MCP host configuration, guide the user through loading the Maya plugin, and run a first live-tool smoke prompt.
maya-import-to-scene
Pipeline stage — structured asset import. Consume an AssetDescriptor produced by maya-asset-source and import the asset (FBX, OBJ, USD) into the current Maya scene via cmds.file(). Handles axis/unit conversion, MaterialMode, PlacementHint, and optional target collection grouping. Returns an ImportToSceneResult with…
maya-asset-source
Pipeline stage — asset discovery and resolution. Search local asset libraries, resolve paths to structured AssetDescriptor records, and surface candidate assets for downstream import. Use before maya-import-to-scene to locate what to import.
maya-mock-async
Synthetic async skill for gateway integration tests. Sleeps for N seconds and reports progress every 500 ms. No actual Maya installation required — uses MayaStandaloneDispatcher.