cloudai-threejs

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is an unverified GitHub repository from an unknown account and the install instruction runs code fetched from that repo (via npx/skills), which can execute arbitrary code—making it potentially suspicious without further trust indicators (stars, forks, maintainer reputation, signed releases).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install step will fetch and execute remote code via "npx skills add CloudAI-X/threejs-skills" (which pulls from the referenced repository https://github.com/CloudAI-X/threejs-skills), so it has a runtime external dependency that executes remote code.