tuzi-post-to-x

SUSPICIOUS. The stated purpose broadly matches X posting automation, and the Bun installer appears to be official rather than a third-party payload. However, the skill’s core TypeScript scripts are missing, so the actual data flows and browser automation behavior cannot be verified; combined with anti-bot-bypass framing, local profile/session use, clipboard/paste automation, and process-kill instructions, this leaves meaningful uncertainty and medium security risk.

This module is a dual-use cross-platform keystroke injection utility that performs a real paste (Cmd+V/Ctrl+V equivalents) to the active/frontmost application and explicitly aims to bypass synthetic paste-event detection. No network exfiltration or persistence is present in the provided code, but the behavior is inherently security-sensitive (UI input automation) and can be abused for clipboard-driven attacks. The highest concrete technical risk is on macOS: user-supplied --app is interpolated into dynamically constructed AppleScript executed via osascript without escaping/validation, creating an AppleScript-evaluation injection risk. Overall: elevated security risk; treat as high-impact automation code and restrict/validate inputs when used.