threejs-model-generate

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references jsDelivr CDN (https://cdn.jsdelivr.net/npm/fflate@0.8.2/esm/browser.js) to fetch the fflate library at runtime, constituting a common unofficial operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates a paid text-to-3D and image-to-3D generation API (Tripo API) which incurs credit costs for tasks such as text, image, rig, and retarget operations (SKILL.md:16, SKILL.md:110). This constitutes a direct financial operation (purchasing/generating paid model assets). Access control to the API is handled via an API key passed via --api-key or TRIPO_API_KEY (SKILL.md:37), providing authenticated service API credentials to access the paid endpoint. Therefore, it is a direct operation with qualifying independent access control.