bitnet

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime scripts download and load external model weights via huggingface-cli (e.g., model id "microsoft/BitNet-b1.58-2B-4T-gguf" fetched at runtime) and the installer clones remote code (https://github.com/microsoft/BitNet.git); the fetched model weights are required at runtime and directly determine the agent's outputs, so this is a runtime external dependency that controls the agent.