このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。

バージョン付きセキュリティ評価

レポートID: SA-8BC790DF

7/6/2026, 4:05:01 PM

baoyu-post-to-x セキュリティ評価 v3

スキルセキュリティ認証レポート

監査履歴
監査モデル: codex 過去のレポート
スキル名
baoyu-post-to-x
バージョン
v3
メンテナー
JimLiu
カバレッジ
9 スキャンされたファイル · 2,790 解析済み行数
ポリシーバージョン
利用不可

確認済みの検出結果における最高重大度

重大

7 件の確認済みセキュリティ検出結果に対応が必要です。

インストールのコンテキスト

履歴上の証拠

このレポートは、現在インストール可能な成果物を説明していない可能性があります。インストールに関するガイダンスについては、現在の Skill ページを開いてください。

現在のスキルページを開く

このレポートは、マニフェストまたは ZIP をブロックも承認もしません。

The skill provides legitimate X posting features, but it relies on high-risk browser and host automation. Confirmed issues include external process execution, CDP control of a persistent Chrome profile, real paste keystrokes, anti-automation evasion, and unsafe handling of untrusted article content. Many markdown and template-literal alerts are false positives, but the remaining risks require remediation before broad marketplace publication.

レポートの位置

過去のレポート

このレポートを使用してインストールする前に、監査履歴を開いてください。

監査アテステーション

証明不可

必要な不変のバインディングは不完全です。

人による検証

未検証

このレポートには人による検証は記録されていません。

カバレッジ

9 スキャンされたファイル · 2,790 解析済み行数

レビュー対象の項目を 48 件表示

制限事項

このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。

証拠チェーン

ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。

  1. ソース

    バインディングは利用できません

  2. アーティファクト

    IDが不完全

  3. 監査

    完了

  4. インストール契約

    検証するためにマニフェストを開く

    マニフェストを開く

確認された機能

「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。

スクリプトを含む

Skillに含まれるコードを実行する場合があります。

1 件の証拠箇所で確認

ネットワークアクセス

外部サービスに接続する場合があります。

14 件の証拠箇所で確認

ファイルシステムへのアクセス

ローカルファイルの読み取りまたは書き込みを行う可能性があります。

28 件の証拠箇所で確認

環境変数

プロセス環境から値を読み取る可能性があります。

4 件の証拠箇所で確認

外部コマンド

Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。

161 件の証拠箇所で確認

機能レビュー項目 (41)
高
Node.js child_process module
import { spawn } from 'node:child_process';
The script executes OS clipboard utilities through child_process. Arguments are mostly structured, but running platform tools from a marketplace skill is a real host-level capability.
高
Process spawn
const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'] });
The script executes OS clipboard utilities through child_process. Arguments are mostly structured, but running platform tools from a marketplace skill is a real host-level capability.
高
Process spawn
const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'] });
The script executes OS clipboard utilities through child_process. Arguments are mostly structured, but running platform tools from a marketplace skill is a real host-level capability.
高
PowerShell invocation
await runCommand('powershell.exe', ['-NoProfile', '-Sta', '-Command', ps, '-Path', imagePath]);
PowerShell is invoked to write image or HTML data to the Windows clipboard. The arguments are not shell-concatenated, but this is still sensitive host automation.
高
PowerShell invocation
await runCommand('powershell.exe', ['-NoProfile', '-Sta', '-Command', ps, '-Path', htmlFilePath]);
PowerShell is invoked to write image or HTML data to the Windows clipboard. The arguments are not shell-concatenated, but this is still sensitive host automation.
高
Node.js child_process module
import { spawnSync } from 'node:child_process';
The script runs osascript to activate applications and send paste keystrokes. The target application name is interpolated into AppleScript, creating a real command-injection and UI-automation risk.
高
Synchronous spawn
const result = spawnSync('osascript', ['-e', script], { stdio: 'pipe' });
The script runs osascript to activate applications and send paste keystrokes. The target application name is interpolated into AppleScript, creating a real command-injection and UI-automation risk.
高
Synchronous spawn
const result = spawnSync('osascript', ['-e', script], { stdio: 'pipe' });
The script runs osascript to activate applications and send paste keystrokes. The target application name is interpolated into AppleScript, creating a real command-injection and UI-automation risk.
高
Synchronous spawn
const result = spawnSync(tool.cmd, tool.args, { stdio: 'pipe' });
The script invokes xdotool or ydotool to send Ctrl+V to the active Linux desktop. This is intentional UI automation, but it can paste clipboard content into the wrong focused application.
高
Synchronous spawn
const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' });
The script invokes PowerShell SendKeys to send Ctrl+V on Windows. This can affect the active foreground application and is a real host UI-automation risk.
高
Ruby/shell backtick execution
const script = `
This is a TypeScript template literal, not Ruby shell syntax, but it builds AppleScript executed by osascript. The app name is interpolated without escaping, so the risk is real.
高
Ruby/shell backtick execution
? `
This is a TypeScript template literal, not Ruby shell syntax, but it builds AppleScript executed by osascript. The app name is interpolated without escaping, so the risk is real.
高
Ruby/shell backtick execution
: `
This is a TypeScript template literal, but it contains OS paste automation later executed through osascript or PowerShell. The behavior is sensitive even though it is not Ruby backtick execution.
高
Ruby/shell backtick execution
const ps = `
This is a TypeScript template literal, but it contains OS paste automation later executed through osascript or PowerShell. The behavior is sensitive even though it is not Ruby backtick execution.
高
PowerShell invocation
const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' });
PowerShell SendKeys sends a real paste shortcut to the desktop. This is sensitive because focus mistakes can paste clipboard contents outside the intended browser.
高
Node.js child_process module
import { spawn, spawnSync } from 'node:child_process';
The article workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser profile and performs clipboard automation.
高
Process spawn
const chrome = spawn(chromePath, [
The article workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser profile and performs clipboard automation.
高
Synchronous spawn
const result = spawnSync('npx', ['-y', 'bun', copyScript, 'image', imagePath], { stdio: 'inherit' })
The article workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser profile and performs clipboard automation.
高
Synchronous spawn
const result = spawnSync('npx', ['-y', 'bun', copyScript, 'html', '--file', htmlPath], { stdio: 'inh
The article workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser profile and performs clipboard automation.
高
Synchronous spawn
const result = spawnSync(args[0]!, args.slice(1), { stdio: 'inherit' });
The article workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser profile and performs clipboard automation.
高
Ruby/shell backtick execution
`--remote-debugging-port=${port}`,
This is a TypeScript template literal, not shell backticks, but it configures Chrome remote debugging and the user-data profile. That exposes a powerful browser-control surface.
高
Ruby/shell backtick execution
`--user-data-dir=${profileDir}`,
This is a TypeScript template literal, not shell backticks, but it configures Chrome remote debugging and the user-data profile. That exposes a powerful browser-control surface.
高
Node.js child_process module
import { spawn, spawnSync } from 'node:child_process';
The posting workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser and triggers clipboard or paste automation.
高
Process spawn
const chrome = spawn(chromePath, [
The posting workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser and triggers clipboard or paste automation.
高
Synchronous spawn
const result = spawnSync('npx', ['-y', 'bun', copyScript, 'image', imagePath], { stdio: 'inherit' })
The posting workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser and triggers clipboard or paste automation.
高
Synchronous spawn
const result = spawnSync(args[0]!, args.slice(1), { stdio: 'inherit' });
The posting workflow launches helper scripts and Chrome from the host. It uses structured arguments, but it controls a logged-in browser and triggers clipboard or paste automation.
高
Ruby/shell backtick execution
`--remote-debugging-port=${port}`,
This is a TypeScript template literal, not shell backticks, but it configures Chrome remote debugging and the user-data profile. That exposes a powerful browser-control surface.
高
Ruby/shell backtick execution
`--user-data-dir=${profileDir}`,
This is a TypeScript template literal, not shell backticks, but it configures Chrome remote debugging and the user-data profile. That exposes a powerful browser-control surface.
中
Ruby/shell backtick execution
return `import AppKit
This is a TypeScript template literal, but it generates Swift source that is written to disk and executed to access the clipboard. The source is fixed, yet the host clipboard capability is real.
中
Node.js fs operations
fs.unlinkSync(destPath);
These cleanup operations delete the destination path used for remote image downloads. The path is normally internal, but predictable temp usage makes the file operation worth keeping for review.
中
Node.js fs operations
fs.unlinkSync(destPath);
These cleanup operations delete the destination path used for remote image downloads. The path is normally internal, but predictable temp usage makes the file operation worth keeping for review.
中
Node.js fs operations
fs.unlink(destPath, () => {});
These cleanup operations delete the destination path used for remote image downloads. The path is normally internal, but predictable temp usage makes the file operation worth keeping for review.
中
File stream creation
const file = fs.createWriteStream(destPath);
The workflow writes and reads article HTML or downloaded images through temporary paths. Some paths are predictable, which creates tampering and cleanup risks on shared systems.
中
Temp directory access
const tempDir = options?.tempDir ?? path.join(os.tmpdir(), 'x-article-images');
The workflow writes and reads article HTML or downloaded images through temporary paths. Some paths are predictable, which creates tampering and cleanup risks on shared systems.
中
WebSocket connection
const ws = new WebSocket(url);
The WebSocket connects to Chrome DevTools Protocol and can drive an authenticated browser session. It is local and intended, but it is still a powerful browser-control channel.
中
Node.js fs operations
const htmlContent = fs.readFileSync(htmlPath, 'utf-8');
The workflow writes and reads article HTML or downloaded images through temporary paths. Some paths are predictable, which creates tampering and cleanup risks on shared systems.
中
Synchronous file operations
const htmlContent = fs.readFileSync(htmlPath, 'utf-8');
The workflow writes and reads article HTML or downloaded images through temporary paths. Some paths are predictable, which creates tampering and cleanup risks on shared systems.
中
Temp directory access
const htmlPath = path.join(os.tmpdir(), 'x-article-content.html');
The workflow writes and reads article HTML or downloaded images through temporary paths. Some paths are predictable, which creates tampering and cleanup risks on shared systems.
中
WebSocket connection
const ws = new WebSocket(url);
The WebSocket connects to Chrome DevTools Protocol and can drive an authenticated browser session. It is local and intended, but it is still a powerful browser-control channel.
低
Fetch API call
const res = await fetch(url, { redirect: 'follow' });
The fetch call polls the local Chrome DevTools endpoint rather than an external service. It is part of the CDP control flow, so it remains a low-confidence confirmed automation risk.
低
Fetch API call
const res = await fetch(url, { redirect: 'follow' });
The fetch call polls the local Chrome DevTools endpoint rather than an external service. It is part of the CDP control flow, so it remains a low-confidence confirmed automation risk.

リスク指摘

確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。

確認済みのセキュリティ上の懸念 (7)

RISK-001 重大
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
The skill combines host command execution, CDP network control, clipboard automation, and a persistent logged-in browser profile. I did not find credential exfiltration, but the combination can automate sensitive account actions.
RISK-002 高
Prompt Injection Attempt Detected
The file states "safe_to_publish": true and "All static findings are false positives" inside an authoritative-looking evaluation. This can bias automated reviewers and should not be trusted.
The file contains a prewritten security verdict inside the skill package. It does not explicitly say to ignore instructions, but it presents safety conclusions that could influence an audit.
RISK-003 高
Anti-Automation Evasion Intent
The skill states that it bypasses anti-automation detection and launches Chrome with automation indicators disabled. This is intentional platform-evasion behavior, not just ordinary posting support.
The stated description and Chrome launch flags directly confirm anti-automation bypass intent. This is a clear semantic risk beyond simple command execution.
RISK-004 高
Persistent Chrome Profile Exposed Through CDP
The scripts launch Chrome with a persistent user-data directory and a DevTools debugging port. Any local process that reaches the port during execution could control the logged-in browser session.
The code explicitly reuses a profile directory and enables Chrome remote debugging. The risk is local rather than remote internet exposure, so confidence is high but not absolute.
RISK-005 高
Unescaped AppleScript Injection Surface
The paste helper interpolates the target application name into AppleScript before executing osascript. A crafted app name could alter the AppleScript unless it is escaped or restricted to an allowlist.
The command is executed through osascript and the app name comes from a CLI argument. The interpolation is visible and no escaping is present.
RISK-006 高
Unsanitized Markdown HTML Injected Into Authenticated Page
Markdown text is converted into HTML without full escaping and then inserted into the X editor through CDP paste or insertHTML flows. Untrusted Markdown could alter the authenticated page DOM.
The converter escapes code blocks but not regular paragraph HTML before browser insertion. X may sanitize content, but the script still injects untrusted HTML into an authenticated page.
RISK-007 中
Unrestricted Remote Image Download From Markdown
Markdown image URLs are downloaded from arbitrary http or https locations with no private-network block, content-length limit, or MIME validation. This can create SSRF-like local requests or resource exhaustion.
The code directly downloads user-controlled image URLs and follows redirects. Legitimate remote images are supported, but missing restrictions create a credible abuse path.

是正措置

この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。

  1. FIX-001
    高
    Anti-automation evasion behavior
    Remove bypass-oriented language and Chrome flags, or replace the workflow with official X API integrations and clear user consent controls.
  2. FIX-002
    高
    Persistent Chrome profile exposed through remote debugging
    Use an isolated temporary profile, close Chrome reliably, and document the local CDP exposure before any browser session starts.
  3. FIX-003
    高
    OS clipboard and keystroke automation
    Require explicit confirmation before paste actions, verify the target window, and provide a non-keystroke fallback where possible.
  4. FIX-004
    高
    Unescaped AppleScript target application input
    Escape AppleScript string values or restrict target applications to a fixed allowlist before invoking osascript.
  5. FIX-005
    高
    Unsanitized Markdown HTML insertion
    Sanitize generated HTML and escape raw Markdown text before inserting content into the authenticated X page.
  6. FIX-006
    高
    Embedded audit verdict in package content
    Remove prewritten safety conclusions from packaged skill files so marketplace review is based only on trusted audit inputs.
  7. FIX-007
    中
    Unrestricted remote image downloads
    Block private IP ranges, require HTTPS, validate MIME types, enforce file-size limits, and clean temporary files reliably.

専門家による証拠

不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。

アーティファクト主体

Marketplace コミット
利用不可
コンテンツハッシュ
利用不可
ツリーハッシュ
利用不可
Skill パス
利用不可
監査ペイロードハッシュ
利用不可

分析メタデータ

監査モデル: codex

分析状態: 完了

対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。

静的解析の誤検知を無視 (18)
重大
Keylogger keywords
"finding": "[CRITICAL] blocker: Keylogger keywords at SKILL.md:26, scripts/paste-from-clipboard.ts:5
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
"reasoning": "Terms 'keystroke', 'paste', 'clipboard' refer to legitimate OS clipboard APIs (osascri
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
"finding": "[CRITICAL] blocker: Keylogger keywords at references/regular-posts.md:87,97",
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
"reasoning": "Documentation describing paste keystroke automation. Standard clipboard API documentat
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
"finding": "[CRITICAL] blocker: Keylogger keywords at scripts/x-article.ts:546",
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
"reasoning": "Comment references paste operation for images. Uses paste-from-clipboard.ts helper, no
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
"Send real paste keystrokes (Cmd+V/Ctrl+V) to bypass detection",
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
4. **Paste images using osascript** (macOS): Sends real Cmd+V keystroke to Chrome, bypassing CDP's s
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
3. Send real Cmd+V keystroke via `osascript` and System Events
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
console.log(`Send real paste keystroke (Cmd+V / Ctrl+V) to the frontmost application
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
// Build script that activates app (if specified) and sends keystroke in one atomic operation
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
keystroke "v" using command down
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
keystroke "v" using command down
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
console.log(`[paste] Sending paste keystroke (retries=${retries}, delay=${delayMs}ms)...`);
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
console.log('[paste] Paste keystroke sent successfully');
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
console.error('[paste] Failed to send paste keystroke');
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
// Paste image using paste script (activates Chrome, sends real keystroke)
Force-confirmed blocker/critical static finding; AI dismissal overridden.
重大
Keylogger keywords
| `scripts/paste-from-clipboard.ts` | Send real paste keystroke |
Force-confirmed blocker/critical static finding; AI dismissal overridden.

検証とエクスポート

マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。

監査アテステーション: not_attestable