baoyu-post-to-weibo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts call npx -y bun at runtime (see runBunScript -> spawnSync('npx', ['-y','bun', ...]) in weibo-utils), which will fetch and execute the bun package from the npm registry (e.g. https://registry.npmjs.org/) as a required runtime dependency for the clipboard/paste helper scripts.