3d-animation-creator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most links are standard (GitHub, a trusted CDN, a personal Vercel site, and localhost) but the presence of a raw install.sh intended to be fetched/executed (curl|bash style) and a repo/clone from an unvetted GitHub user makes this a potentially risky distribution vector that should be inspected before running.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path can ingest outsider-authored free text when the user selects “From an existing website” and the agent uses WebFetch to retrieve arbitrary public page content, then extracts that page’s copy/specs/features into the generated HTML/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's optional Card Scanner section injects an external script tag that will be fetched and executed at site runtime — https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js — meaning the generated site depends on remote code execution when that feature is included.