theatrejs

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains runtime imports of remote JavaScript from the CDN (https://cdn.jsdelivr.net/npm/@theatre/browser-bundles@0.5.0-insiders.88df1ef/dist/core-and-studio.js and https://cdn.jsdelivr.net/npm/@theatre/browser-bundles@0.5.0-insiders.88df1ef/dist/core-only.min.js) which execute remote code in the browser, and an install snippet that clones a GitHub repository (https://github.com/fulopkovacs/vanilla-threejs-project) then runs install/start commands — both fetch and execute external code at runtime.