Skills x-publish
📦
x-publish
Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access🌐 Network access
Draft X Posts and Threads
Posting AI-written threads manually can be slow and error prone. This skill opens X, pastes prepared content, and saves drafts for review.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "x-publish" from https://skillstore.io/skills/kangarooking-x-publish.md and its manifest at https://skillstore.io/api/skills/kangarooking-x-publish/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "x-publish". Save a one-post announcement as an X draft.
Expected outcome:
Draft saved. Review it in X drafts before publishing.
Using "x-publish". Save a three-part product thread as a draft.
Expected outcome:
Thread draft saved with three posts. Review the thread in X drafts.
Using "x-publish". Try to draft a post while the browser is not logged in.
Expected outcome:
Please log in to X first, then run the draft workflow again.
Security Audit
Medium Riskv6 • 7/9/2026 Open versioned report
Most Markdown backtick detections are false positives from documentation and examples, and the Linux subprocess calls use fixed command arrays without shell interpolation. Confirmed risks remain around local helper execution, temporary file staging, authenticated browser automation against X, and writing post text to the system clipboard.
2
Files scanned
413
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Authenticated X Draft Creation
The skill uses browser automation in a logged-in X session to paste content and save drafts. It avoids auto-publish, but it still changes state in the user account.
The workflow explicitly requires a logged-in X session and includes compose, paste, close, and save-draft steps. The intent and account-side effect are clear.
Medium
scripts/copy_to_clipboard.py:22-29scripts/copy_to_clipboard.py:41-45scripts/copy_to_clipboard.py:67-90
System Clipboard Modification
The helper script writes user-provided post content to the operating system clipboard. Other local applications may read clipboard contents before the user replaces them.
The platform-specific implementations directly clear or write clipboard contents using AppKit, pyperclip, win32clipboard, xclip, or xsel.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Temp directory access
python copy_to_clipboard.py text --file /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
Medium
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
Medium
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
Medium
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
Medium
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
Medium
Ruby/shell backtick execution
```
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
Medium
Temp directory access
python scripts/copy_to_clipboard.py text --file /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
Medium
Temp directory access
echo "Tweet content" > /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
Medium
Temp directory access
python scripts/copy_to_clipboard.py text --file /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
Low
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
Low
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
Low
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
Low
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
Risk Factors
⚙️ External commands (50)
scripts/copy_to_clipboard.py:74 scripts/copy_to_clipboard.py:85 SKILL.md:15 SKILL.md:16 SKILL.md:36-42 SKILL.md:42-49 SKILL.md:49-55 SKILL.md:55-58 SKILL.md:58-60 SKILL.md:60-63 SKILL.md:63-67 SKILL.md:67-70 SKILL.md:70-73 SKILL.md:73-76 SKILL.md:76-78 SKILL.md:78-84 SKILL.md:84-90 SKILL.md:90-93 SKILL.md:93-95 SKILL.md:95-98 SKILL.md:98-100 SKILL.md:100-101 SKILL.md:101-104 SKILL.md:104-108 SKILL.md:108-111 SKILL.md:111-114 SKILL.md:114-117 SKILL.md:117-120 SKILL.md:120-122 SKILL.md:122-127 SKILL.md:127-130 SKILL.md:130-133 SKILL.md:133-136 SKILL.md:136-139 SKILL.md:139-141 SKILL.md:141-159 SKILL.md:159-161 SKILL.md:161-164 SKILL.md:164-166 SKILL.md:166-179 SKILL.md:179-183 SKILL.md:183-185 SKILL.md:185-195 SKILL.md:195-198 SKILL.md:198-203 SKILL.md:203-205 SKILL.md:205-230 SKILL.md:230-235 SKILL.md:235-238 SKILL.md:238-241
📁 Filesystem access (4)
🌐 Network access (9)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/kangarooking-x-publish/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/kangarooking-x-publish?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/kangarooking-x-publish?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kangarooking-x-publish/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/kangarooking-x-publish.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
kangarooking. (2026). x-publish security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/kangarooking-x-publish/audits/6BibTeX citation
@techreport{kangarooking-kangarooking-x-publish-2026,
author = {kangarooking},
title = {x-publish security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/kangarooking-x-publish/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "x-publish security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "kangarooking"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/kangarooking-x-publish/audits/6"
identifiers:
- type: other
value: "skillstore:kangarooking-x-publish:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 45
Architecture
85
Maintainability
85
Content
69
Community
83
Spec Compliance
What You Can Build
Save a Launch Announcement
Stage a short product update in X drafts so it can be reviewed before posting.
Prepare a Campaign Thread
Convert prepared campaign copy into a connected X thread draft.
Stage Technical Notes
Move a concise research or engineering note into X drafts without manual copy and paste.
Try These Prompts
Save a Short Draft
Use x-publish to save this as an X draft: [post text]. Do not publish it.
Save a Thread Draft
Use x-publish to save this thread as X drafts. Keep each post under 280 characters: [thread text].
Review Then Draft
Check this post for length and obvious formatting issues, then use x-publish to save it as an X draft: [post text].
Stage Campaign Copy
Use x-publish to stage these approved campaign posts as an X thread draft. Preserve order and report the draft location: [numbered posts].
Best Practices
- Review every draft in X before manual publication.
- Keep sensitive or embargoed information out of clipboard-based workflows.
- Confirm each post is within the X character limit before saving a draft.
Avoid
- Do not use the skill to publish automatically or bypass final human review.
- Do not place secrets, tokens, or private customer data in post text.
- Do not rely on the workflow when X compose elements have changed.
Frequently Asked Questions
Does this skill publish posts automatically?
No. It saves content as an X draft and expects the user to publish manually.
Does it support threads?
Yes. It can add multiple posts to a thread draft when the content is split into separate posts.
What browser access is required?
It requires browser automation access and an X session where the user is already logged in.
Why does it use the clipboard?
The helper script copies prepared text so browser automation can paste it into X compose.
Can it upload media?
No. The documented workflow handles text posts and text threads only.
Can it validate content policy or legal risk?
No. Users must review drafts for accuracy, policy, legal, and brand requirements.
Developer Details
Author
kangarookingLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
0519034dad657fb1f7706e0550e962beeda73fdf
Maintenance freshness
7/18/2026
Usage
5 downloads · 134 views
File structure