baoyu-post-to-x

Pass

Audited by Gen Agent Trust Hub on Mar 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses spawn and spawnSync to execute various system-level utilities and scripts, including osascript (macOS), powershell (Windows), swift, xdotool, and ydotool (Linux). These are used to manage the system clipboard and simulate real keystrokes for pasting content into the browser, which is a core function to avoid automation detection.
  • [EXTERNAL_DOWNLOADS]: The md-to-html.ts script includes functionality to download images from HTTPS URLs specified within Markdown content. This is used to process remote images for long-form 'X Articles'.
  • [PROMPT_INJECTION]: The SKILL.md file contains instructions for the agent to automatically resolve environment issues, such as killing existing Chrome CDP instances and retrying commands if a debug port is not ready. These instructions are functional and specific to the browser automation workflow.
  • [DYNAMIC_EXECUTION]: Several scripts (e.g., check-paste-permissions.ts and copy-to-clipboard.ts) dynamically generate and execute small Swift or PowerShell scripts to interact with platform-specific system APIs (like AppKit for clipboard management). This behavior is intended for the primary purpose of cross-platform automation.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 14, 2026, 06:32 AM