threejs-claude-skill-package

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install step (npx skills add OpenAEC-Foundation/Three.js-Claude-Skill-Package) and the upstream GitHub URL (https://github.com/OpenAEC-Foundation/Three.js-Claude-Skill-Package) show the agent will fetch and install remote code at runtime, which executes external code and supplies the skill's instructions.