Versioned security assessment

Report ID: SA-88A205C7

7/8/2026, 5:04:00 PM

x-article-publisher security assessment v3

Skill Security Certification Report

Audit model: codex Historical report

Skill name: x-article-publisher
Version: v3
Maintainer: ZhanlinCui
Source: github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/x-article-publisher
Coverage: 3 Files scanned · 855 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static command findings in SKILL.md are Markdown formatting or tool references, not Ruby backtick execution. Confirmed risks are intentional X network navigation, local helper command execution, predictable temporary draft files, and clipboard exposure. No prompt injection attempt or obfuscated payload was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 855 Lines analyzed

21 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 9 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 62 evidence locations

Capability review items (19)

Medium

Ruby/shell backtick execution

- Python 3.9+ with dependencies: `pip install Pillow pyobjc-framework-Cocoa`

The prerequisite includes a pip install command that downloads and installs Python packages. This is intended setup work, but it changes the local environment.

Medium

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:116-118

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:140-142

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:188-191

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:217-220

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:296-300

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:306-308

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

SKILL.md:311-313

Ruby/shell backtick execution

```bash

The documented workflow instructs the agent to run local Python helper commands. The commands are intended, but executing scripts on user-selected files remains a command-execution risk surface.

Medium

Temp directory access

2. 生成 HTML 文件到 /tmp/

The workflow stores article HTML or JSON in predictable /tmp paths. Draft content could be exposed or collide with another process on shared systems.

Medium

Temp directory access

python parse_markdown.py article.md --html-only > /tmp/article_html.html

The workflow stores article HTML or JSON in predictable /tmp paths. Draft content could be exposed or collide with another process on shared systems.

Medium

Temp directory access

python ~/.claude/skills/x-article-publisher/scripts/copy_to_clipboard.py html --file /tmp/article_ht

The workflow stores article HTML or JSON in predictable /tmp paths. Draft content could be exposed or collide with another process on shared systems.

Medium

Temp directory access

python ~/.claude/skills/x-article-publisher/scripts/parse_markdown.py /path/to/article.md > /tmp/art

The workflow stores article HTML or JSON in predictable /tmp paths. Draft content could be exposed or collide with another process on shared systems.

Medium

Temp directory access

python ~/.claude/skills/x-article-publisher/scripts/parse_markdown.py /path/to/article.md --html-onl

The workflow stores article HTML or JSON in predictable /tmp paths. Draft content could be exposed or collide with another process on shared systems.

Medium

Temp directory access

python ~/.claude/skills/x-article-publisher/scripts/copy_to_clipboard.py html --file /tmp/article_ht

The workflow stores article HTML or JSON in predictable /tmp paths. Draft content could be exposed or collide with another process on shared systems.

Low

Hardcoded URL

browser_navigate: https://x.com/compose/articles

The skill intentionally navigates a browser to X Articles. This is expected behavior, but it sends draft content to an external web service when used.

Low

Hardcoded URL

browser_navigate: https://x.com/compose/articles

The skill intentionally navigates a browser to X Articles. This is expected behavior, but it sends draft content to an external web service when used.

Low

Hardcoded URL

2. Navigate to https://x.com/compose/articles

The skill intentionally navigates a browser to X Articles. This is expected behavior, but it sends draft content to an external web service when used.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium

scripts/parse_markdown.py:194-220 scripts/parse_markdown.py:246-248

Markdown HTML Is Not Escaped Before Clipboard Use

The parser converts Markdown to HTML with regex substitutions and wraps remaining text without escaping user content or validating link schemes. Unsafe HTML or links in a source draft could be copied into the X editor draft.

The conversion path directly interpolates Markdown-derived text into HTML output. The code shown does not escape text nodes or restrict link URL schemes before clipboard use.

RISK-002 Low

SKILL.md:184-190 SKILL.md:215-219

Article Content Is Placed On The System Clipboard

The workflow instructs copying generated article HTML and images to the system clipboard before browser paste. Clipboard data can be read by other local applications, so sensitive drafts may be exposed during use.

The skill explicitly directs clipboard use for both HTML and image insertion. This is intended behavior, but the shared clipboard creates a real local privacy risk.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Medium
Predictable temporary files may contain unpublished article content.

Use per-run temporary files with restrictive permissions and delete them after clipboard paste.
FIX-002
Medium
Markdown text is converted to HTML without clear escaping or link validation.

Escape user text, validate link schemes, and reject unsafe raw HTML before copying to the clipboard.
FIX-003
Medium
Setup installs external Python packages.

Pin dependency versions and document trusted package sources for Pillow and PyObjC.
FIX-004
Low
Article HTML and images are placed on the system clipboard.

Warn users to clear the clipboard after sensitive drafts and avoid shared machines.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable