baoyu-post-to-x

SUSPICIOUS. The core capability matches the stated purpose, and data goes to X through local Chrome rather than an obvious exfiltration service. However, this is a high-impact automation skill for public posting, includes anti-bot bypass framing, uses an unpinned curl|bash install path for Bun, reads config from home/project directories, and can automatically kill local Chrome debug processes; these combined make it medium overall risk.

This module is a dual-use cross-platform keystroke injection utility that performs a real paste (Cmd+V/Ctrl+V equivalents) to the active/frontmost application and explicitly aims to bypass synthetic paste-event detection. No network exfiltration or persistence is present in the provided code, but the behavior is inherently security-sensitive (UI input automation) and can be abused for clipboard-driven attacks. The highest concrete technical risk is on macOS: user-supplied --app is interpolated into dynamically constructed AppleScript executed via osascript without escaping/validation, creating an AppleScript-evaluation injection risk. Overall: elevated security risk; treat as high-impact automation code and restrict/validate inputs when used.