baoyu-post-to-weibo
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes platform-specific automation tools to perform clipboard operations and simulate keystrokes, which are necessary for interacting with the Weibo web interface.
- On Windows, it uses
powershell.exeto set clipboard content and send theCtrl+Vkeystroke. - On macOS, it uses
osascript(AppleScript) to execute temporary Swift code for clipboard management and to simulateCmd+Vkeystrokes. - On Linux, it leverages
xdotoolorydotoolto send keystrokes. - The implementation uses safe practices, such as
JSON.stringify()when injecting strings into browser contexts and proper quote escaping in PowerShell commands, to prevent injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill's instructions involve the use of
npx -y bun, which may download the Bun runtime if it is not already installed on the system. Bun is a well-known and trusted development tool. - [SAFE]: The skill does not handle user credentials directly, requiring the user to log in manually in the browser. It also includes verification steps to ensure content is correctly placed before the user manually publishes it.
Audit Metadata