threejs-loaders

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill is a Three.js usage guide for loading externally provided asset URLs/models via loaders (e.g., GLTFLoader.load / TextureLoader.load / manager URL modifier), so outsider-authored free text can become readable runtime content when it is used as a URL/resource path or injected into loader inputs by the caller.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill sets runtime decoder/transcoder paths that will fetch and execute remote decoder code (DRACO decoder at https://www.gstatic.com/draco/versioned/decoders/1.5.6/ and Basis/KTX2 transcoder at https://cdn.jsdelivr.net/npm/three@0.160.0/examples/jsm/libs/basis/), which are required runtime dependencies that execute code in the client to decode assets.