x-article-publisher

Name: x-article-publisher
Author: ZhanlinCui

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Publish Markdown Drafts to X Articles

Publishing long Markdown posts to X can require repetitive formatting and image placement. This skill converts Markdown and guides draft creation in X Articles.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "x-article-publisher" from https://skillstore.io/skills/zhanlincui-x-article-publisher.md and its manifest at https://skillstore.io/api/skills/zhanlincui-x-article-publisher/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/zhanlincui-x-article-publisher.md Signed manifest GET /api/skills/zhanlincui-x-article-publisher/manifest Signed lockfile GET /api/skills/zhanlincui-x-article-publisher/lockfile

Test it

Using "x-article-publisher". Publish my Markdown article to X Articles.

Expected outcome:

Draft saved in X Articles with the extracted title, cover image, and formatted body. Please review and publish manually.

Using "x-article-publisher". Prepare a technical essay with several images.

Expected outcome:

The article draft is ready. Images were inserted from later positions to earlier positions to preserve placement.

Using "x-article-publisher". Check whether this article can be converted cleanly.

Expected outcome:

The Markdown is suitable for conversion, but complex tables may need manual formatting after the draft is created.

Security Audit

Medium Risk

v4 • 7/8/2026 Open versioned report

Most static command findings in SKILL.md are Markdown formatting or tool references, not Ruby backtick execution. Confirmed risks are intentional X network navigation, local helper command execution, predictable temporary draft files, and clipboard exposure. No prompt injection attempt or obfuscated payload was found in the reviewed files.

Files scanned

855

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

scripts/parse_markdown.py:194-220 scripts/parse_markdown.py:246-248

Markdown HTML Is Not Escaped Before Clipboard Use

The parser converts Markdown to HTML with regex substitutions and wraps remaining text without escaping user content or validating link schemes. Unsafe HTML or links in a source draft could be copied into the X editor draft.

The conversion path directly interpolates Markdown-derived text into HTML output. The code shown does not escape text nodes or restrict link URL schemes before clipboard use.

Low

SKILL.md:184-190 SKILL.md:215-219

Article Content Is Placed On The System Clipboard

The workflow instructs copying generated article HTML and images to the system clipboard before browser paste. Clipboard data can be read by other local applications, so sensitive drafts may be exposed during use.

The skill explicitly directs clipboard use for both HTML and image insertion. This is intended behavior, but the shared clipboard creates a real local privacy risk.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:14

Ruby/shell backtick execution

- Python 3.9+ with dependencies: `pip install Pillow pyobjc-framework-Cocoa`

The prerequisite includes a pip install command that downloads and installs Python packages. This is intended setup work, but it changes the local environment.

Medium

SKILL.md:22-24

Ruby/shell backtick execution

```bash