threejs-gltf-loading

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill configures runtime decoder/transcoder paths that fetch and execute remote decoder code from the jsDelivr CDN (e.g. https://cdn.jsdelivr.net/npm/three@0.184.0/examples/jsm/libs/draco/ and the base CDN path https://cdn.jsdelivr.net/npm/three@0.184.0/examples/jsm/libs/) which are required dependencies for DRACO/KTX2/Meshopt decoding and thus constitute executing remote code at runtime.