alpha-cutout
Alpha-cutout keys an AI-generated or filmed clip shot on a flat chroma plate into transparent web video: stacked-alpha MP4, VP9 alpha WebM or WebP frame sequences. The bundle is actually the whole 'Open 3D Skills' repo, eight skills for 3D and animated websites.
What it can touch
| files | write, including ~/.claude/skills, ~/.codex/skills, ~/.cursor/skills, ~/.gemini/skills, ~/.config/opencode/skills, ~/.agents/skills, ~/.open-3d-skills, ~/.cache/ms-playwright |
|---|---|
| network | cdn.jsdelivr.net, github.com, raw.githubusercontent.com |
| shell | runs commands |
| secrets | none found |
What it actually does
The skills are markdown instructions for building three.js scenes, scroll films, chroma-keyed video, cursor-following head rigs, exploded views, AI asset planning, headless browser checks and frame-exact recording. The local Python scripts process media with numpy, OpenCV and Pillow and shell out to ffmpeg and ffprobe using argument lists. They drive headless Chromium and WebKit through Playwright, against URLs the user gives. They also include a static file server with Range support that binds to 127.0.0.1 by default. The browser JS modules are rendering and playback code. The demo pages load three.js from cdn.jsdelivr.net. The optional install.sh clones the GitHub repo to ~/.open-3d-skills, or git-pulls it if already there. It then symlinks or copies each skill into the skills folder of every coding agent it detects. It can uninstall what it created. No credential access, exfiltration, hidden instructions, obfuscation or persistence beyond the skill links themselves was found.
What the check found
mediumDownloads a script and runs it straight away
Piping a download into a shell runs code nobody reviewed, and the download can change after this check.
README.md:103 curl -fsSL https://raw.githubusercontent.com/Moh4696/open-3d-skills/main/install.sh | bash
mediumDownloads a script and runs it straight away
Piping a download into a shell runs code nobody reviewed, and the download can change after this check.
install.sh:5 # curl -fsSL https://raw.githubusercontent.com/Moh4696/open-3d-skills/main/install.sh | bash
Keep an eye on it
This check is of one commit. Watch alpha-cutout and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/moh4696-open-3d-skills)About this check
Checked November 2, 2026 at commit 7b04ab491d5b, 64 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.