Baoyu Post To X

This skill will launch a real Chrome instance, rely on a persistent Chrome profile (to use your logged-in X session), and use system clipboard + OS automation (osascript/xdotool/powershell) to paste images — it requires Chrome and the bun runtime even though the registry metadata lists none. Before installing or running it: - Treat it as powerful: running it with your default Chrome profile lets it act from your logged-in X account and gives access to cookies and other browser data. Prefer creating and specifying a dedicated Chrome profile directory with --profile to isolate credentials. - Expect to grant OS automation/accessibility permissions (macOS Accessibility, xdotool/ydotool, etc.). Only grant these if you trust the code. - The skill reads $HOME/.baoyu-skills/baoyu-post-to-x/EXTEND.md and project .baoyu-skills/... files for config — review those files if present and be cautious about placing secrets there. - The code downloads remote images referenced in Markdown; network I/O is expected but review md-to-html.ts for allowed hosts if you have concerns. - If you need to proceed, inspect x-utils.js (not shown in the summary) for any unexpected network endpoints, file writes outside temp directories, or code that reads other local secrets. Run the skill in a sandboxed environment or VM first, and avoid using your primary Chrome profile. Summary recommendation: do not install blindly. The behavior is consistent with posting via a real browser, but the metadata underreports the privileges and filesystem access; treat this skill as high-privilege and only use it with explicit isolation and review.