inspect-glb

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs using npx @gltf-transform/cli with a specific version (4.4.2), which fetches code and behavior-selecting configuration from the npm registry at runtime, constituting an external runtime dependency with common/reputable unofficial provenance.