spline-3d-integration

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime imports of remote JavaScript from the unpkg CDN (https://unpkg.com/@splinetool/viewer/build/spline-viewer.js and https://unpkg.com/@splinetool/runtime@latest/build/runtime.module.js) which are fetched and executed in-page as required dependencies to render Spline scenes, so they constitute runtime external code execution.