teardown
A skill that builds interactive 3D simulators of real machines (a V8 engine, a Cessna 337 landing gear, a Strandbeest) as single offline HTML pages with live panels, cutaways, views and an auto tour. It also records them frame by frame to 60 fps video with a procedurally synthesised, timeline-synced score.
What it can touch
| files | write, including C:\Users\user_\.claude\bin\ffmpeg.exe |
|---|---|
| network | registry.npmjs.org |
| shell | runs commands |
| secrets | none found |
What it actually does
The agent installs npm dependencies (three, esbuild, playwright, fonts) and the Playwright Chromium browser. Node scripts do the work. build.mjs bundles each sims/<name>/main.js with esbuild into one self-contained HTML file in ./teardown-out/dist. capture.mjs opens that file in headless Chromium, steps window.SIM.render(t) frame by frame, screenshots each frame and pipes the frames to ffmpeg. sheet.mjs and wave.mjs call ffmpeg and ffprobe to make contact sheets, waveforms and loudness readings. A pure-Python stdlib sound engine (run_sfx.py, sfx/) loads a cue-sheet .py file, synthesises audio and writes a WAV. The browser code is three.js scenes, DOM consoles, an auto-tour cursor and pointer and keyboard controls. It makes no network calls at runtime, reads no credentials and installs nothing that keeps running. One weakness: the page runtime merges a base64 JSON config taken from the URL (?config=), and the director overlay writes some of that config's story text into the page with innerHTML.
What the check found
mediumPublished pages accept a URL config that can inject HTML (possible XSS)
loadConfig merges a base64 JSON object from the ?config= query parameter into the sim config. That object can switch on the director and supply cfg.story entries, whose kind, tag and text are inserted into the page with innerHTML and no escaping. If a page built by this skill is hosted on a site, a crafted link could run script on that page's origin. The fix is to escape story text or use textContent, or to drop ?config on live pages.
sims/kit/runtime.js:43 cfg = merge(cfg, JSON.parse(fromBase64(q.get('config'))));
sims/kit/director.js:237 storyEl.innerHTML = `<div class="cap ${cur.kind || 'hero'}">
sims/kit/director.js:238 ${cur.tag ? `<div class="cap-tag">${cur.tag}</div>` : ''}
Keep an eye on it
This check is of one commit. Watch teardown and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/elvarofficial-teardown)About this check
Checked November 2, 2026 at commit a91262ac1109, 73 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.