
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
@img2threejs/pixi2d
Advanced tools
Installer-only CLI for the private img2pixi2d native OMP skill plugin.
Installer-only CLI for img2pixi2d, the private native OMP skill plugin for editable PixiJS 2D reconstruction. This npm package includes only the installer, metadata, this README and its Apache-2.0 license. It does not include the private skill, Python tools, examples, artwork or credentials. The installer license does not license the private source or user artwork.
PATH.img2threejs/pixi2d repository. The public npm installer does not grant repository access.venv/pip; install prepares an isolated Pillow environment.PATH for removal: OMP's native uninstall uses Bun even when OMP itself is a compiled executable.Configure private Git access without embedding credentials:
gh auth login --hostname github.com --git-protocol https
gh auth setup-git --hostname github.com
npx --yes @img2threejs/pixi2d@latest install --dry-run
npx --yes @img2threejs/pixi2d@latest install --yes
npx --yes @img2threejs/pixi2d@latest doctor
npx --yes @img2threejs/pixi2d@latest update --yes
npx --yes @img2threejs/pixi2d@latest remove --yes
The first --yes authorizes npx downloading the public CLI. The final --yes authorizes installer mutations. Without the final flag, mutations fail before touching HOME. --dry-run is offline and does not run subprocesses or write HOME.
Install clones https://github.com/img2threejs/pixi2d.git into ~/.local/share/img2threejs/pixi2d, checks out ea55d1534ad215ddb8060732ae581dbe2a662cb8, installs pinned Python requirements in its .venv, then registers it using omp plugin link. Keep the checkout: OMP links it by symlink. Start a new OMP session in your existing host project and invoke /skill:img2pixi2d with a readable reference image.
Update uses the source pin of the CLI version you run; it does not pull an unreviewed default branch. Existing checkouts must have the expected Git origin and no tracked/untracked changes. A registration pointing elsewhere is never replaced. To reuse another authorized clone, pass its absolute --directory on every command:
npx --yes @img2threejs/pixi2d@latest install --yes --directory /absolute/path/to/pixi2d
npx --yes @img2threejs/pixi2d@latest doctor --directory /absolute/path/to/pixi2d
Remove delegates to omp plugin uninstall pixi2d. It unregisters only; the source checkout, .venv, and host artwork remain. Doctor checks this installer's Git pin, skill file, Pillow import, matching native OMP registration and native plugin diagnostics; it is not a visual reconstruction review.
This is not an img2 harness plugin: img2 add pixi2d is not supported. The executable is img2pixi2d; the npm package is @img2threejs/pixi2d. --version reports installer version 0.1.0, independently of source skill version 1.0.0.
Run npm test in cli/, inspect npm pack --dry-run, then tag cli-v0.1.0. The pinned reusable workflow publishes only cli/ via npm Trusted Publishing. Provenance is disabled because the GitHub source repository is private. Source root package.json remains private: true.
FAQs
Installer-only CLI for the private img2pixi2d native OMP skill plugin.
The npm package @img2threejs/pixi2d receives a total of 30 weekly downloads. As such, @img2threejs/pixi2d popularity was classified as not popular.
We found that @img2threejs/pixi2d demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.