threejs

SUSPICIOUS: this catalogue entry is mostly benign on its own, but it serves as a pointer to an upstream workflow with inconsistent install provenance. The CloudAI-X repo reportedly directs installation from a different unverified repo, creating a disproportionate transitive supply-chain risk for a skill whose local content does almost nothing.