Versioned security assessment

Report ID: SA-63B75DA6

7/1/2026, 2:58:37 AM

x-article-publisher security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
x-article-publisher
Version
v2
Maintainer
ZhanlinCui
Source
github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/x-article-publisher
Coverage
3 Files scanned · 855 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis produced many alerts, but most high-severity weak-crypto, entropy, and reconnaissance matches are false positives from words, argparse setup, comments, or documentation examples. Real risks remain because the skill intentionally runs local Python scripts, reads user-selected files, writes temporary HTML, controls the system clipboard, and opens X in a browser. No evidence found of malicious exfiltration, destructive commands, or prompt injection.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 855 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 5 evidence locations

Capability review items (2)
Medium
SKILL.md:188-190SKILL.md:217-219scripts/copy_to_clipboard.py:53-84scripts/copy_to_clipboard.py:97-114
Local Script Execution and Clipboard Control
TRUE POSITIVE: The skill instructs the agent to run Python helper scripts and those scripts copy image or HTML data to the macOS clipboard. This is expected for rich-text publishing, but it gives the workflow access to local files and clipboard contents, so users should only run it on trusted Markdown and image files.
The command examples and implementation clearly show local scripts writing image and HTML data to NSPasteboard. The behavior is intentional and useful, but it is a real local data-handling risk.
Medium
SKILL.md:139-141scripts/parse_markdown.py:253-283scripts/copy_to_clipboard.py:160-165
Filesystem Reads and Temporary File Workflow
TRUE POSITIVE: The skill reads local Markdown, image, and HTML files and recommends writing generated HTML to /tmp. This is necessary for the workflow, but it may expose sensitive article content or local paths if users process untrusted or private files without review.
The parser and clipboard helper directly read paths supplied by the user, and the instructions explicitly use a temporary HTML file. The risk is bounded to local file handling, not hidden collection.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
scripts/parse_markdown.py:194-250
Unescaped Markdown-to-HTML Conversion
NEEDS REVIEW: The converter builds HTML with regular expressions and inserts Markdown link text, href values, and paragraph content without HTML escaping. This can preserve unsafe markup or misleading links in the draft when the input Markdown is untrusted, even though no direct code execution was observed.
The conversion function directly interpolates Markdown content into HTML strings. Browser and X editor sanitization may reduce impact, but the skill itself does not sanitize untrusted content.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (4)
Low
SKILL.md:1-3scripts/copy_to_clipboard.py:126-128scripts/parse_markdown.py:287-289
Weak-Crypto and Entropy Alerts Are False Positives
FALSE POSITIVE: The reported weak cryptographic algorithm matches do not identify cryptographic operations in context. The cited script lines define argparse parsers, and the SKILL.md line is metadata describing Markdown publishing; no hashing, encryption, or authentication logic was found there.
The cited lines contain YAML metadata or argparse setup, not cryptographic API calls. The entropy alert is explained by mixed natural language and code examples in documentation.
Low
scripts/parse_markdown.py:157-186
System Reconnaissance Alerts Are False Positives
FALSE POSITIVE: The reported reconnaissance lines are part of title extraction comments and logic in the Markdown parser. No commands collect hostnames, users, processes, network interfaces, or other system inventory.
The relevant code only scans Markdown lines to choose an article title. There is no system API or shell call that performs host reconnaissance.
Low
SKILL.md:146-158SKILL.md:302
Hardcoded X URL Is Expected
FALSE POSITIVE: The hardcoded network destination is the X Articles compose page required by the skill. No evidence found that article data or credentials are sent to an unrelated endpoint.
The only documented URL is the expected X compose endpoint for the publishing workflow. The scripts do not make network requests.
Low
SKILL.md:18SKILL.md:116-118SKILL.md:188-190SKILL.md:217-219SKILL.md:296-307
Hidden Directory References Are Installation Paths
FALSE POSITIVE WITH RESIDUAL RISK: The hidden home-directory references point to the expected Claude skill installation path. This is not stealthy persistence, but it still means users execute scripts from a hidden tool directory.
The references consistently identify where the skill scripts are installed and how to invoke them. I did not find writes to hidden startup files or persistence mechanisms.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable