baoyu-danger-x-to-markdown
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
scripts/constants.tsincludes a hardcoded public bearer token (DEFAULT_BEARER_TOKEN) used for X guest authentication. - [COMMAND_EXECUTION]: The skill automates a Chrome browser through
scripts/cookies.tsto manage authentication. It useschild_process.spawnto launch the browser and utilizes the Chrome DevTools Protocol (CDP) to extract login cookies. - [EXTERNAL_DOWNLOADS]: The skill communicates with
x.comandabs.twimg.comto fetch tweet content, article data, and dynamically resolve API identifiers needed for conversion. - [DATA_EXFILTRATION]: The skill accesses local application data directories (e.g.,
~/Library/Application Support/baoyu-skills/or~/.local/share/baoyu-skills/) to store and retrieve authentication cookies and user consent records. - [PROMPT_INJECTION]: The skill processes untrusted text from X (tweets and articles), creating an indirect prompt injection surface. An agent consuming the resulting Markdown could be influenced by instructions hidden in the converted text.
- Ingestion Point:
scripts/graphql.ts(API responses from X). - Boundary Markers: Employs Markdown formatting and YAML frontmatter.
- Capability: Writes converted content to the local file system.
- Sanitization: No specific filtering is applied to the tweet or article text to detect or remove malicious instructions.
Audit Metadata