threejs-gltf-loading

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Runtime workflow only reads and parses glTF/GLB model files loaded via GLTFLoader (e.g., loader.load(url, ...) and associated decoders like DRACOLoader/KTX2Loader), so outsider-provided model content could be ingested as free text only insofar as it is represented in the glTF file fields.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly sets decoder/transcoder paths to CDN URLs (e.g., https://cdn.jsdelivr.net/npm/three@0.184.0/examples/jsm/libs/draco/) which will be fetched at runtime to load/execute decoder code (WASM/JS) required for DRACO/KTX2 decoding.