image-to-3d

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx commands (e.g., "npx -y luxin-cli@latest" at runtime) which fetch and execute remote code and it explicitly points to a hosted LLM contract that can supply prompts/instructions (https://luxin.sh/llms.txt), so external content can directly control prompts or execute code.