hyperframes-scene-animator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill loads and executes a third‑party runtime script (GSAP) from https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js via in multiple HTML files (the render log even shows "Inlined CDN script: https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"), so remote code is fetched and executed at skill runtime and is relied on for timeline/animation behavior.