Baoyu Post To X

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:35 AM UTC
• Version: 1.58.1

Overview

The skill is broadly aligned with posting to X, but it needs review because it can automate real browser sessions, manipulate the clipboard, publish publicly, and automatically terminate Chrome debugging processes.

Install only if you are comfortable letting the skill control a real Chrome/X session, use your clipboard, send paste keystrokes, and keep X login state in a Chrome profile. Avoid --submit unless you have just reviewed the exact post or article, and do not allow the automatic Chrome-process kill step unless you are sure no other debugging Chrome session matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs the agent to use shell commands, environment-derived paths, and runtime resolution (`bun`/`npx`), yet the metadata declares no permissions. That creates a transparency and policy-enforcement gap: an agent or reviewer may treat the skill as lower-risk than it is, despite it having host and browser automation capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The description frames the skill as simply posting to X, but the body authorizes broader capabilities: quote-posting, Markdown/HTML transformation, clipboard manipulation, OS-level paste keystroke injection, and environment diagnostics. This mismatch increases the chance that users or enforcement systems approve the skill for a narrower purpose while overlooking sensitive host-interaction features.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically kill existing Chrome/Chromium processes with remote debugging enabled. Unilateral host-level process termination can disrupt unrelated user sessions, destroy unsaved state, and interfere with other tools that intentionally use CDP, which exceeds what is necessary for a posting workflow.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The documentation says scripts only prepare content for manual review by default, but it also exposes a `--submit` path that can publish an article automatically. For a public-posting skill, any hidden or underemphasized auto-submit capability raises the risk of accidental or unauthorized external publication if an agent invokes it incorrectly.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script invokes `npx -y bun --version`, which can fetch and execute code from the npm ecosystem during a mere environment check. That creates an unnecessary supply-chain and arbitrary code execution risk, especially because users may run this diagnostic script with their normal privileges before using the X-posting skill.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This script sends real OS-level paste keystrokes to whichever application is frontmost, or to an attacker-controlled app name on macOS, via osascript/xdotool/ydotool/PowerShell. That capability is broader than posting to X and can redirect arbitrary clipboard contents into other apps, chats, terminals, password fields, or admin prompts if focus is wrong or manipulated, creating an unintended data leakage and UI-injection risk.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code explicitly reads X/Twitter browser cookies and checks for the presence of authentication/session values (`auth_token`, `ct0`). Even if used only to verify login state, this is credential-adjacent handling that exceeds a simple posting helper's minimum needs and creates unnecessary exposure of sensitive session material if reused, logged, or exfiltrated elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The helper executes `npx -y bun ...`, which can invoke external tooling and potentially trigger package resolution at runtime. That expands the attack surface beyond posting to X: a compromised PATH, package source, or helper invocation path could lead to unintended code execution on the host.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Authorizing the agent to kill existing Chrome CDP instances automatically and without user warning is unsafe because it performs destructive host actions outside the immediate X-posting task. In this skill context, that behavior is more dangerous because users are likely expecting browser automation, not process management that can impact unrelated work.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The guide instructs copying arbitrary images into the system clipboard and sending real paste keystrokes to the active Chrome window, but it does not explicitly warn that this will overwrite the user's clipboard and can affect whichever application has focus if window targeting fails. In an automation skill that drives a real browser, this can cause unintended disclosure or user confusion, even if the intent is just normal posting.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The troubleshooting text tells users to configure Chrome and notes that cookies are saved, but it does not clearly warn that a persistent browser profile retains login sessions and other browsing artifacts on disk. In a skill that automates posting to a social account, this creates privacy and session-retention risk if the profile is shared, reused unexpectedly, or left on a less secure system.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script proceeds to send a paste keystroke without warning the user where clipboard contents will be delivered, even though clipboard data may contain secrets or unrelated sensitive text. In a UI automation context, a focus mistake or malicious redirection could silently exfiltrate clipboard contents into the wrong application or field.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When --submit is set, the script clicks X's publish button immediately after composing content, with no final confirmation or explicit warning that the action will post publicly. In an automation skill that can be invoked by an agent, this increases the risk of unintended public posting caused by user misunderstanding, prompt injection, or malformed upstream instructions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When --submit is provided, the script clicks X's tweet button directly with no final confirmation or dry-run checkpoint immediately before posting. Because posting to a social account is an irreversible external side effect, this increases the risk of accidental publication of unintended, malformed, or attacker-supplied content in an automation context.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "type": "module",
  "dependencies": {
    "baoyu-chrome-cdp": "^0.1.1",
    "baoyu-md": "^0.1.1",
    "front-matter": "^4.0.2",
    "highlight.js": "^11.11.1",

• Confidence: 92% confidence
• Finding: "baoyu-chrome-cdp": "^0.1.1"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"type": "module",
  "dependencies": {
    "baoyu-chrome-cdp": "^0.1.1",
    "baoyu-md": "^0.1.1",
    "front-matter": "^4.0.2",
    "highlight.js": "^11.11.1",
    "marked": "^15.0.6",

• Confidence: 91% confidence
• Finding: "baoyu-md": "^0.1.1"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "baoyu-chrome-cdp": "^0.1.1",
    "baoyu-md": "^0.1.1",
    "front-matter": "^4.0.2",
    "highlight.js": "^11.11.1",
    "marked": "^15.0.6",
    "remark-cjk-friendly": "^1.1.0",

• Confidence: 95% confidence
• Finding: "front-matter": "^4.0.2"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"baoyu-chrome-cdp": "^0.1.1",
    "baoyu-md": "^0.1.1",
    "front-matter": "^4.0.2",
    "highlight.js": "^11.11.1",
    "marked": "^15.0.6",
    "remark-cjk-friendly": "^1.1.0",
    "remark-parse": "^11.0.0",

• Confidence: 95% confidence
• Finding: "highlight.js": "^11.11.1"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"baoyu-md": "^0.1.1",
    "front-matter": "^4.0.2",
    "highlight.js": "^11.11.1",
    "marked": "^15.0.6",
    "remark-cjk-friendly": "^1.1.0",
    "remark-parse": "^11.0.0",
    "remark-stringify": "^11.0.0",

• Confidence: 95% confidence
• Finding: "marked": "^15.0.6"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"front-matter": "^4.0.2",
    "highlight.js": "^11.11.1",
    "marked": "^15.0.6",
    "remark-cjk-friendly": "^1.1.0",
    "remark-parse": "^11.0.0",
    "remark-stringify": "^11.0.0",
    "unified": "^11.0.5"

• Confidence: 90% confidence
• Finding: "remark-cjk-friendly": "^1.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"highlight.js": "^11.11.1",
    "marked": "^15.0.6",
    "remark-cjk-friendly": "^1.1.0",
    "remark-parse": "^11.0.0",
    "remark-stringify": "^11.0.0",
    "unified": "^11.0.5"
  }

• Confidence: 94% confidence
• Finding: "remark-parse": "^11.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"marked": "^15.0.6",
    "remark-cjk-friendly": "^1.1.0",
    "remark-parse": "^11.0.0",
    "remark-stringify": "^11.0.0",
    "unified": "^11.0.5"
  }
}

• Confidence: 94% confidence
• Finding: "remark-stringify": "^11.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"remark-cjk-friendly": "^1.1.0",
    "remark-parse": "^11.0.0",
    "remark-stringify": "^11.0.0",
    "unified": "^11.0.5"
  }
}

• Confidence: 94% confidence
• Finding: "unified": "^11.0.5"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/copy-to-clipboard.ts:59

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/paste-from-clipboard.ts:107

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/x-utils.ts:90