threejs-loaders

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls DRACOLoader.setDecoderPath("https://www.gstatic.com/draco/versioned/decoders/1.5.6/") and KTX2Loader.setTranscoderPath("https://cdn.jsdelivr.net/npm/three@0.160.0/examples/jsm/libs/basis/") which are runtime CDN paths used to fetch decoder/transcoder binaries (JS/WASM) that will be executed in the runtime to decode assets, so these external URLs directly supply remote code the skill depends on.