threejs-game-dev

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The HTML pages include runtime importmap and script tags that fetch and execute remote libraries the skill requires — notably Three.js from https://unpkg.com/three@0.160.0/build/three.module.js (and its examples base https://unpkg.com/three@0.160.0/examples/jsm/), plus other runtime assets (https://cdn.tailwindcss.com, https://fonts.googleapis.com, https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/) — so these URLs are runtime external dependencies that will execute fetched code.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for high-entropy literal values that could provide access.

Flagged:

• The Asana URL in figma.mcp.issues: https://form.asana.com/?k=kBG-ejRQTdY8x_H6a4vM3Q&d=10497086658021 The query parameter value "kBG-ejRQTdY8x_H6a4vM3Q" is a high‑entropy token-like string embedded in a URL and is likely an access key for that form. It is not a placeholder, not truncated/redacted, and appears usable — so I treat it as a secret.

Ignored / not flagged:

• Local file paths (e.g., C:\Users\gemma...), commands, and configuration flags (xpra options, importmaps, loader paths) — these are not secrets.
• UI/sample strings, simple words, and example passwords (none matching high-entropy secret patterns) — treated as documentation or placeholders.
• No API secret prefixes (sk-...), private key blocks, JWTs, or other obvious long credentials were present elsewhere.

Therefore I report that at least one real, high-entropy credential-like value is present (the Asana k=... token).