技能 x-publish
📦
x-publish
内容修订 r1 中风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问
起草 X 帖子和帖子串
手动发布由 AI 编写的帖子串可能很慢且容易出错。此技能会打开 X，粘贴准备好的内容，并保存草稿以供审核。
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "x-publish" from https://skillstore.io/skills/kangarooking-x-publish.md and its manifest at https://skillstore.io/api/skills/kangarooking-x-publish/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“x-publish”。 将一条公告保存为 X 草稿。
预期结果:
草稿已保存。发布前请在 X 草稿中审核。
正在使用“x-publish”。 将三部分产品帖子串保存为草稿。
预期结果:
包含三条帖子的帖子串草稿已保存。请在 X 草稿中审核该帖子串。
正在使用“x-publish”。 在浏览器未登录时尝试起草帖子。
预期结果:
请先登录 X，然后再次运行草稿工作流。
安全审计
中风险v6 • 2026/7/9 打开版本化报告
Most Markdown backtick detections are false positives from documentation and examples, and the Linux subprocess calls use fixed command arrays without shell interpolation. Confirmed risks remain around local helper execution, temporary file staging, authenticated browser automation against X, and writing post text to the system clipboard.
2
已扫描文件
413
分析行数
13
复核项
0
已忽略误报
已确认安全问题 (2)
中
Authenticated X Draft Creation
The skill uses browser automation in a logged-in X session to paste content and save drafts. It avoids auto-publish, but it still changes state in the user account.
The workflow explicitly requires a logged-in X session and includes compose, paste, close, and save-draft steps. The intent and account-side effect are clear.
中
scripts/copy_to_clipboard.py:22-29scripts/copy_to_clipboard.py:41-45scripts/copy_to_clipboard.py:67-90
System Clipboard Modification
The helper script writes user-provided post content to the operating system clipboard. Other local applications may read clipboard contents before the user replaces them.
The platform-specific implementations directly clear or write clipboard contents using AppKit, pyperclip, win32clipboard, xclip, or xsel.
能力复核项 (13)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Temp directory access
python copy_to_clipboard.py text --file /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
中
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
中
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
中
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
中
Ruby/shell backtick execution
```bash
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
中
Ruby/shell backtick execution
```
This Markdown section instructs the agent to run local shell or Python helper commands during the draft workflow. The command use is bounded, but it is still an external command side effect.
中
Temp directory access
python scripts/copy_to_clipboard.py text --file /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
中
Temp directory access
echo "Tweet content" > /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
中
Temp directory access
python scripts/copy_to_clipboard.py text --file /tmp/tweet.txt
The workflow documents staging tweet text in /tmp before copying it. Temporary files can expose draft content or leave it behind after the workflow finishes.
低
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
低
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
低
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
低
Hardcoded URL
browser_navigate: https://x.com/compose/post
The skill directs browser automation to open the X compose page in an authenticated browser session. This is intended, but it is a real external network and account-state interaction.
风险因素
⚙️ 外部命令 (50)
scripts/copy_to_clipboard.py:74 scripts/copy_to_clipboard.py:85 SKILL.md:15 SKILL.md:16 SKILL.md:36-42 SKILL.md:42-49 SKILL.md:49-55 SKILL.md:55-58 SKILL.md:58-60 SKILL.md:60-63 SKILL.md:63-67 SKILL.md:67-70 SKILL.md:70-73 SKILL.md:73-76 SKILL.md:76-78 SKILL.md:78-84 SKILL.md:84-90 SKILL.md:90-93 SKILL.md:93-95 SKILL.md:95-98 SKILL.md:98-100 SKILL.md:100-101 SKILL.md:101-104 SKILL.md:104-108 SKILL.md:108-111 SKILL.md:111-114 SKILL.md:114-117 SKILL.md:117-120 SKILL.md:120-122 SKILL.md:122-127 SKILL.md:127-130 SKILL.md:130-133 SKILL.md:133-136 SKILL.md:136-139 SKILL.md:139-141 SKILL.md:141-159 SKILL.md:159-161 SKILL.md:161-164 SKILL.md:164-166 SKILL.md:166-179 SKILL.md:179-183 SKILL.md:183-185 SKILL.md:185-195 SKILL.md:195-198 SKILL.md:198-203 SKILL.md:203-205 SKILL.md:205-230 SKILL.md:230-235 SKILL.md:235-238 SKILL.md:238-241
📁 文件系统访问 (4)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/kangarooking-x-publish/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/kangarooking-x-publish?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/kangarooking-x-publish?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kangarooking-x-publish/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/kangarooking-x-publish.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
kangarooking. (2026). x-publish security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/kangarooking-x-publish/audits/6BibTeX 引用
@techreport{kangarooking-kangarooking-x-publish-2026,
author = {kangarooking},
title = {x-publish security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/kangarooking-x-publish/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "x-publish security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "kangarooking"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/kangarooking-x-publish/audits/6"
identifiers:
- type: other
value: "skillstore:kangarooking-x-publish:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 高 45
架构
85
可维护性
85
内容
69
社区
83
规范符合性
你能构建什么
保存发布公告
将简短的产品更新暂存到 X 草稿中，以便发布前审核。
准备活动帖子串
将准备好的活动文案转换为关联的 X 帖子串草稿。
暂存技术笔记
将简洁的研究或工程笔记移入 X 草稿，无需手动复制粘贴。
试试这些提示
保存短草稿
使用 x-publish 将此内容保存为 X 草稿：[post text]。不要发布它。
保存帖子串草稿
使用 x-publish 将此帖子串保存为 X 草稿。确保每条帖子少于 280 个字符：[thread text]。
先审核再起草
检查此帖子的长度和明显格式问题，然后使用 x-publish 将其保存为 X 草稿：[post text]。
暂存活动文案
使用 x-publish 将这些已批准的活动帖子暂存为 X 帖子串草稿。保留顺序并报告草稿位置：[numbered posts]。
最佳实践
- 手动发布前，请在 X 中审核每一份草稿。
- 不要在基于剪贴板的工作流中包含敏感或受限发布的信息。
- 保存草稿前，确认每条帖子都在 X 字符限制内。
避免
- 不要使用此技能自动发布或绕过最终人工审核。
- 不要在帖子文本中放入密钥、令牌或客户私有数据。
- 当 X 编写元素已发生变化时，不要依赖此工作流。
常见问题
此技能会自动发布帖子吗？
不会。它会将内容保存为 X 草稿，并预期用户手动发布。
它支持帖子串吗？
支持。当内容被拆分为单独帖子时，它可以向帖子串草稿中添加多条帖子。
需要什么浏览器访问权限？
它需要浏览器自动化访问权限，以及用户已登录的 X 会话。
为什么它使用剪贴板？
辅助脚本会复制准备好的文本，以便浏览器自动化将其粘贴到 X 编写框中。
它可以上传媒体吗？
不能。文档化工作流仅处理文本帖子和文本帖子串。
它可以验证内容政策或法律风险吗？
不能。用户必须审核草稿是否符合准确性、政策、法律和品牌要求。
开发者详情
作者
kangarooking许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
0519034dad657fb1f7706e0550e962beeda73fdf
维护新鲜度
2026/7/18
使用量
5 次下载 · 134 次浏览
文件结构