baoyu-post-to-weibo
Warn
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
spawnSyncandprocess.killto automate high-privilege UI interactions and manage Chrome processes. scripts/paste-from-clipboard.tsexecutesosascript(macOS),powershell.exe(Windows), andxdotool/ydotool(Linux) to simulate real user paste events to bypass anti-bot detection.scripts/copy-to-clipboard.tsdynamically generates a Swift script, writes it to a temporary file, and executes it via theswiftcompiler on macOS.scripts/weibo-utils.tsandscripts/weibo-article.tsusepkillandprocess.killto terminate Chrome instances based on profile paths.- [REMOTE_CODE_EXECUTION]: The skill dynamically imports JavaScript modules from an external CDN at runtime.
scripts/vendor/baoyu-md/src/utils/languages.tsusesimport()to load syntax highlighting language packages fromhttps://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/.- [EXTERNAL_DOWNLOADS]: The skill fetches resources from external URLs during processing.
scripts/vendor/baoyu-md/src/images.tscontains adownloadFilefunction that fetches images from arbitrary URLs provided in Markdown content.scripts/vendor/baoyu-md/src/extensions/plantuml.tscommunicates withhttps://www.plantuml.com/plantumlfor remote diagram rendering.- [DYNAMIC_EXECUTION]: The skill uses Chrome DevTools Protocol (CDP) to execute arbitrary JavaScript in the browser context via
Runtime.evaluate. scripts/weibo-article.tsandscripts/weibo-post.tsinject and run complex JavaScript strings to interact with the Weibo web interface, including setting values and triggering events.
Audit Metadata