Skills baoyu-danger-x-to-markdown

📦

baoyu-danger-x-to-markdown

Name: baoyu-danger-x-to-markdown
Author: jimliu

v1.117.3 Content revision r2 High Risk 📁 Filesystem access🌐 Network access⚙️ External commands🔑 Env variables⚡ Contains scripts

Convert X Posts to Markdown

Saving X posts and articles manually loses structure, metadata, and media references. This skill retrieves selected X content and organizes it as Markdown with YAML front matter and optional local media.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "baoyu-danger-x-to-markdown" from https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown.md and its manifest at https://skillstore.io/api/skills/jimliu-baoyu-danger-x-to-markdown/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/jimliu-baoyu-danger-x-to-markdown.md Signed manifest GET /api/skills/jimliu-baoyu-danger-x-to-markdown/manifest Signed lockfile GET /api/skills/jimliu-baoyu-danger-x-to-markdown/lockfile

Test it

Using "baoyu-danger-x-to-markdown". An X thread URL about a software release.

Expected outcome:

A Markdown file with the thread text in order, author metadata, the original source link, and referenced media links.

Using "baoyu-danger-x-to-markdown". An X Article URL with headings, links, and embedded posts.

Expected outcome:

A structured Markdown article with YAML front matter, readable sections, preserved links, and embedded post references.

Using "baoyu-danger-x-to-markdown". A post URL with the local media option enabled.

Expected outcome:

A Markdown file with rewritten local media links.
Separate imgs and videos folders beside the Markdown file.

Security Audit

High Risk

v5 • 8/7/2026 Open versioned report

Most static alerts are false positives caused by ordinary JavaScript template literals, regular expression methods, expected X endpoints, configuration reads, and Markdown file handling. The audit confirms a shell-command injection risk in the WSL path resolver, and it flags deliberate handling of X authentication cookies plus host-controlled media downloads as risks requiring user trust and tighter controls.

Files scanned

4,392

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

scripts/paths.ts:40

Shell Command Injection in WSL Path Discovery

The WSL helper interpolates the value returned by the Windows USERPROFILE query into an execSync shell command. A crafted environment value could change shell parsing and execute an unintended command.

The cited line passes an interpolated value directly to execSync. This is a direct command-construction pattern with a plausible attacker-controlled environment input.

High

scripts/cookies.ts:233-241 scripts/cookie-file.ts:66-80

Persistent X Authentication Cookies

The skill obtains auth_token and related X cookies from environment variables or a Chrome session, then stores them in a local JSON file for later requests. Compromise of that file or process can expose the user account session.

The cited code reads authenticated browser cookies and writes the cookie map to disk. This behavior is explicit and central to authenticated X retrieval.

Medium

scripts/media-localizer.ts:212-232 scripts/media-localizer.ts:287-312

Host-Controlled Media Downloads

Media localization fetches HTTPS URLs taken from Markdown content and writes the response to local files. Untrusted X content can therefore cause requests to attacker-selected hosts unless destinations are allowlisted.

The candidate URL is derived from document content and then fetched with redirects enabled. The feature is legitimate, but its destination boundary is broader than the documented X media hosts.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/paths.ts:40

Synchronous process execution

_wslHome = execSync(`wslpath -u "${raw}"`, { encoding: 'utf-8', timeout: 5000 }).trim() || null;

This call executes a shell command with the value returned from the Windows USERPROFILE query interpolated into the command string. A crafted environment value could alter shell parsing, so the finding is confirmed.

High

scripts/paths.ts:40

Ruby/shell backtick execution

_wslHome = execSync(`wslpath -u "${raw}"`, { encoding: 'utf-8', timeout: 5000 }).trim() || null;

The template literal is passed to execSync and becomes a shell command containing the unvalidated WSL path value. This is executable command construction rather than a harmless formatting template.

Low

scripts/media-localizer.ts:287

Fetch API call

const response = await fetch(downloadUrl, {

The fetch downloads media URLs extracted from Markdown content. This is an intended feature, but the requested content can control the destination and therefore creates a real network exposure.

Risk Factors

📁 Filesystem access (25)

🌐 Network access (50)

scripts/constants.ts:7 scripts/constants.ts:6 scripts/cookies.ts:105 scripts/graphql.ts:235 scripts/graphql.ts:294 scripts/graphql.ts:329 scripts/graphql.ts:82 scripts/graphql.ts:130 scripts/graphql.ts:182 scripts/graphql.ts:218 scripts/graphql.ts:266 scripts/graphql.ts:320 scripts/http.ts:6 scripts/http.ts:18 scripts/main.ts:63 scripts/main.ts:64 scripts/main.ts:65 scripts/main.ts:66 scripts/main.ts:67 scripts/main.ts:500 scripts/main.ts:531 scripts/main.ts:562 scripts/main.ts:616 scripts/markdown.test.ts:59 scripts/markdown.test.ts:60 scripts/markdown.test.ts:120 scripts/markdown.test.ts:121 scripts/markdown.test.ts:154 scripts/markdown.test.ts:155 scripts/markdown.ts:71 scripts/markdown.ts:73 scripts/markdown.ts:298 scripts/media-localizer.ts:287 scripts/media-localizer.ts:60 scripts/referenced-tweets.ts:41 scripts/referenced-tweets.ts:42 scripts/referenced-tweets.ts:75 scripts/thread-markdown.ts:128 scripts/thread-markdown.ts:130 scripts/thread-markdown.ts:212 scripts/tweet-article.ts:48 scripts/tweet-to-markdown.ts:72 scripts/tweet-to-markdown.ts:74 scripts/tweet-to-markdown.ts:110 scripts/tweet-to-markdown.ts:137 SKILL.md:7 SKILL.md:162 SKILL.md:163 SKILL.md:164 SKILL.md:170

⚙️ External commands (50)

🔑 Env variables (36)

⚡ Contains scripts (1)

scripts/media-localizer.ts:227

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/jimliu-baoyu-danger-x-to-markdown/security.svg)](https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jimliu-baoyu-danger-x-to-markdown/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/jimliu-baoyu-danger-x-to-markdown.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

jimliu. (2026). baoyu-danger-x-to-markdown security audit report (audit version 5) [Author version 1.117.3]. Skillstore. https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown/audits/5

BibTeX citation

@techreport{jimliu-jimliu-baoyu-danger-x-to-markdown-2026,
  author = {jimliu},
  title = {baoyu-danger-x-to-markdown security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown/audits/5},
  note = {Author version 1.117.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "baoyu-danger-x-to-markdown security audit report (audit version 5)"
version: "1.117.3"
type: report
authors:
  - name: "jimliu"
date-released: "2026-08-07"
url: "https://skillstore.io/skills/jimliu-baoyu-danger-x-to-markdown/audits/5"
identifiers:
  - type: other
    value: "skillstore:jimliu-baoyu-danger-x-to-markdown:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Archive Research Threads

Convert a research thread into a searchable Markdown note with its source URL, author metadata, and linked media.

Save Articles for Writing

Extract an X Article into an editable Markdown draft for citation, review, and later synthesis.

Build a Personal Knowledge Base

Store selected posts in a predictable folder structure so they can be indexed by local notes and documentation tools.

Try These Prompts

Convert One Post

Convert this X post to Markdown with YAML front matter: [paste the X URL]. Keep the original source link.

Archive a Thread

Convert this X thread to Markdown: [paste the X URL]. Preserve the thread order, author details, source links, and media references.

Extract an Article

Convert this X Article to a clean Markdown document: [paste the X Article URL]. Include YAML front matter, headings, links, embedded posts, and media references.

Create a Local Archive

Convert these X URLs into separate Markdown files: [paste URLs]. Use consistent metadata, organize files by author and post ID, and download media only after asking for confirmation.

Best Practices

Review the consent notice and use a dedicated X session for archival work.
Store cookies securely and enable media downloads only for trusted content.
Keep the generated source URL and metadata so archived notes remain traceable.

Avoid

Do not provide cookies from an account that should not be accessed.
Do not use media localization on untrusted content without network restrictions.
Do not treat the generated Markdown as a complete backup of every X feature.