baoyu-post-to-x
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several system utilities to manage the browser environment and simulate user input.
- It uses
osascript(macOS),powershell.exe(Windows), andxdotoolorydotool(Linux) to send keyboard events for pasting content, which helps bypass social media automation detection. - It instructions the agent to use
pkillto clear stale Chrome debugging processes during troubleshooting. - It spawns Chrome or Chromium processes with the
--remote-debugging-portflag to allow interaction via the Chrome DevTools Protocol (CDP). - [EXTERNAL_DOWNLOADS]: The article conversion script (
md-to-html.ts) is designed to download remote images for use in long-form posts. - It fetches images referenced via HTTPS URLs in Markdown content and saves them to a local temporary directory.
- It includes basic security validation, such as enforcing the HTTPS protocol and limiting the number of HTTP redirects.
Audit Metadata