baoyu-post-to-x
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/md-to-html.tsscript fetches remote images from URLs provided in user-supplied Markdown content using Node.jshttpsandhttpmodules. - [COMMAND_EXECUTION]: The skill spawns Google Chrome or Chromium processes using the
spawnmethod with specific flags like--remote-debugging-portand--user-data-dir. - [COMMAND_EXECUTION]: The skill executes system-level utilities for clipboard and input management across multiple platforms, including
swift(to run temporary AppleScript/AppKit code on macOS),osascript(macOS),powershell.exe(Windows), and various Linux utilities likexclipandxdotool. - [REMOTE_CODE_EXECUTION]: The skill uses the Chrome DevTools Protocol (CDP) to execute JavaScript code snippets within the browser context to interact with the X.com DOM, such as focusing textareas, clicking buttons, and dispatching keyboard events.
Audit Metadata