aframe-webxr
Enables the creation of immersive 3D, VR, and AR web experiences using HTML with minimal JavaScript through A-Frame framework.
Install this skill
or
80/100
Security score
The aframe-webxr skill was audited on May 10, 2026 and we found 12 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
medium line 543
Template literal with variable interpolation in command context
SourceSKILL.md
| 543 | to: `${x} ${y + 1} ${z}`, |
medium line 556
Template literal with variable interpolation in command context
SourceSKILL.md
| 556 | const color = `#${Math.floor(Math.random()*16777215).toString(16)}`; |
low line 59
External URL reference
SourceSKILL.md
| 59 | <script src="https://aframe.io/releases/1.7.1/aframe.min.js"></script> |
low line 585
External URL reference
SourceSKILL.md
| 585 | <script src="https://aframe.io/releases/1.7.1/aframe.min.js"></script> |
low line 586
External URL reference
SourceSKILL.md
| 586 | <script src="https://cdn.jsdelivr.net/npm/@fern-solutions/aframe-sky-background/dist/sky-background.umd.min.js"></script> |
low line 587
External URL reference
SourceSKILL.md
| 587 | <script src="https://cdn.jsdelivr.net/gh/c-frame/[email protected]/dist/aframe-extras.min.js"></script> |
low line 702
External URL reference
SourceSKILL.md
| 702 | <script src="https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.2/gsap.min.js"></script> |
low line 1035
External URL reference
SourceSKILL.md
| 1035 | <img id="texture" src="https://example.com/texture.jpg" crossorigin="anonymous"> |
low line 1064
External URL reference
SourceSKILL.md
| 1064 | - [A-Frame Documentation](https://aframe.io/docs/) |
low line 1066
External URL reference
SourceSKILL.md
| 1066 | - [A-Frame School](https://aframe.io/school/) |
low line 1068
External URL reference
SourceSKILL.md
| 1068 | - [WebXR Device API](https://www.w3.org/TR/webxr/) |
low line 1069
External URL reference
SourceSKILL.md
| 1069 | - [Three.js Documentation](https://threejs.org/docs/) (A-Frame built on Three.js) |
Scanned on May 10, 2026
View Security Dashboard