baoyu-post-to-x
Pass
Audited by Gen Agent Trust Hub on May 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local scripts using the
bunruntime ornpx -y bun. It also utilizes platform-specific commands for system integration: - macOS: Uses
osascript(AppleScript) for sending real paste keystrokes and activating applications, andswiftfor clipboard operations involving images and rich HTML. - Linux: Uses
xclip,wl-copy,xdotool, orydotoolfor clipboard and keystroke automation. - Windows: Uses
powershell.exewithSendKeysfor paste operations and.NETassemblies for clipboard management. - [EXTERNAL_DOWNLOADS]: The
scripts/md-to-html.tsfile includes adownloadFilefunction that fetches remote images specified in Markdown content via HTTPS. It implements safety checks including protocol restriction to HTTPS and a maximum redirect limit. - [REMOTE_CODE_EXECUTION]: While the skill executes local scripts and controls a browser via CDP (Chrome DevTools Protocol), the logic is focused on UI automation of the X.com platform. All browser actions are performed within a real Chrome profile, and the skill explicitly requires user confirmation before final submission/publication.
Audit Metadata