game-asset-pipeline

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The AssetCatalog sets external decoder/transcoder paths to CDNs (https://www.gstatic.com/draco/v1/decoders/ and https://unpkg.com/three/examples/jsm/libs/basis/) which are fetched at runtime by DRACOLoader/KTX2Loader (WASM/decoder code executed in the client), so these URLs are runtime dependencies that cause remote code to be loaded and executed.