threejs

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill sets DRACOLoader's decoder path to https://www.gstatic.com/draco/versioned/decoders/1.5.7/, which is fetched at runtime and loads remote decoder (JS/WASM) code required to decode Draco-compressed models, so it executes external code the skill depends on.