Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nirholas/three.ws --skill 3d-in-readmegit clone --depth 1 https://github.com/nirholas/three.wsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nirholas/three.ws/3d-in-readme)<a href="https://agentmods.dev/skills/nirholas/three.ws/3d-in-readme"><img src="https://agentmods.dev/badge/skills/nirholas/three.ws/3d-in-readme/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nirholas/three.ws/3d-in-readme"><img src="https://agentmods.dev/badge/skills/nirholas/three.ws/3d-in-readme.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 17 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 27 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 35 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.00757 |
| Opus 5.5 | $0.00049 | $0.00303 |
| Sonnet 5.5 | $0.00025 | $0.00151 |
| Haiku 4.5 | $0.00012 | $0.00076 |
Grade A, and why
3d-in-readme scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST https://three.ws/api/v1/ai/text-to-3d \ How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Put a 3D model in GitHub markdown
GitHub renders ASCII STL inside a ```stl fenced code block as an interactive 3D viewer - in READMEs, issues, PRs, discussions, and gists. The readme-3d CLI converts real model files into those blocks.
Workflow
-
Get the model file. Accept
.glb,.gltf,.obj,.stl, or.ast. If the user has no model but describes one, generate it first (step 2); otherwise skip to step 3. -
(Optional) Generate from text. POST to the free three.ws Forge API - no key or account:
curl -s -X POST https://three.ws/api/v1/ai/text-to-3d \ -H 'content-type: application/json' \ -d '{"prompt": "<single object, shape-first description>"}'If
data.statusis"done", downloaddata.glb_url. If"pending", pollGET https://three.ws/api/forge?job=<data.job>every 5 s untilstatusis"done"(allow ~2 min). Shape-first prompts work best: silhouette survives the monochrome STL render, textures do not. -
Convert with a byte budget. Check the target markdown file's current size first, leave headroom under GitHub's 512 KB render limit, and never spend more than ~60% of what remains:
npx readme-3d model.glb --budget <headroom>kb --name <model_name> -o block.mdDefaults are sensible: 1,500 facets max, Y-up→Z-up correction for GLB/OBJ, coordinates normalized. Add
--detailswhen embedding into issues/PR threads so the block collapses. -
Embed. Insert the contents of
block.mdwhere the user wants it (for a README, typically after the intro). Then verify:npx readme-3d check README.mdcheckmust printOK. If it reportsTOO BIG, reconvert with a smaller--budget- never ship a file over the limit, because GitHub will display the entire file as raw text.
Rules
- ASCII STL only - binary STL in a fence renders as gibberish. The CLI always emits ASCII; never hand-build the block from a downloaded
.stlwithout converting. - The viewer is monochrome geometry. Warn the user if their model's identity depends on textures or color.
- One hero model beats several small ones; each block costs 45 KB+.
- The block renders on github.com only (README, issues, PRs, discussions, gists) - not on npm, GitLab, or in IDE previews. Mention this if the file is consumed elsewhere.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 46 lines · 123 tokens per session scan A 3e6da7569649
3d-in-readme is a skill published in the GitHub repository nirholas/three.ws (269 stars, last pushed yesterday), licensed Apache-2.0. It adds 123 tokens to every session and 757 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
3d-in-readme compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| 3d-in-readmenirholas/three.ws | Skill | 269 | yesterday | Apache-2.0 | A | 123 | Claude Code |
| blender-mcpGGbond-bo/MemOmics-Agent | Skill | 31 | yesterday | MIT | A | 17 | Claude Code, Codex |
| blender-mcpmath-inc/OpenGauss | Skill | 1.3k | 7mo ago | MIT | A | 54 | Claude Code, Codex |
| threejs-docspledgeandgrow/pledge-skills | Skill | 10 | 3mo ago | MIT | A | 112 | Claude Code, Codex |
| blender-mcpnativ3ai/hermes-agent-camel | Skill | 193 | yesterday | MIT | A | 53 | Claude Code, Codex |
| 3d-website-architectdeveshpunjabi/3d-website-skill | Skill | 8 | 8mo ago | MIT | A | 240 | Claude Code, Codex |
| blender-mcpraphaelmansuy/edgecrab | Skill | 93 | 3mo ago | none | A | 53 | Claude Code, Codex |