baoyu-electron-extract

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes npx at runtime to fetch and execute remote npm packages (e.g., spawn("npx", ["-y", "@electron/asar", ...]) and spawn("npx", ["-y", "prettier", ...])), which causes remote code to be downloaded and executed during skill runtime.