shader-authoring

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's HyperFrames skeleton loads and executes a remote JavaScript runtime (GSAP) from https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js at page load and then directly uses it (gsap.timeline) to drive rendering, so this external URL is a runtime dependency that executes remote code.