inspect-glb

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source files are outsider-authored GLB binaries provided via the skill’s required runtime command (node <skill-directory>/scripts/inspect.mjs ...), and inspect.mjs ingests free-form content by reading and JSON.parse-ing the embedded GLB JSON chunk and decoding vertex/morph data from the BIN chunk at runtime.