baoyu-post-to-x — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited baoyu-post-to-x (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Posts text, images, videos, and long-form articles to X via real Chrome browser (bypasses anti-bot detection).
Important: All scripts are located in the scripts/ subdirectory of this skill.
Agent Execution Instructions:
SKILL_DIR${SKILL_DIR}/scripts/<script-name>.ts${SKILL_DIR} in this document with the actual pathScript Reference:
| Script | Purpose |
|---|---|
scripts/x-browser.ts | Regular posts (text + images) |
scripts/x-video.ts | Video posts (text + video) |
scripts/x-quote.ts | Quote tweet with comment |
scripts/x-article.ts | Long-form article publishing (Markdown) |
scripts/md-to-html.ts | Markdown → HTML conversion |
scripts/copy-to-clipboard.ts | Copy content to clipboard |
scripts/paste-from-clipboard.ts | Send real paste keystroke |
scripts/check-paste-permissions.ts | Verify environment & permissions |
Use Bash to check EXTEND.md existence (priority order):
# Check project-level first
test -f .baoyu-skills/baoyu-post-to-x/EXTEND.md && echo "project"
# Then user-level (cross-platform: $HOME works on macOS/Linux/WSL)
test -f "$HOME/.baoyu-skills/baoyu-post-to-x/EXTEND.md" && echo "user"┌──────────────────────────────────────────────────┬───────────────────┐ │ Path │ Location │ ├──────────────────────────────────────────────────┼───────────────────┤ │ .baoyu-skills/baoyu-post-to-x/EXTEND.md │ Project directory │ ├──────────────────────────────────────────────────┼───────────────────┤ │ $HOME/.baoyu-skills/baoyu-post-to-x/EXTEND.md │ User home │ └──────────────────────────────────────────────────┴───────────────────┘
┌───────────┬───────────────────────────────────────────────────────────────────────────┐ │ Result │ Action │ ├───────────┼───────────────────────────────────────────────────────────────────────────┤ │ Found │ Read, parse, apply settings │ ├───────────┼───────────────────────────────────────────────────────────────────────────┤ │ Not found │ Use defaults │ └───────────┴───────────────────────────────────────────────────────────────────────────┘
EXTEND.md Supports: Default Chrome profile
bun runtimeBefore first use, suggest running the environment check. User can skip if they prefer.
npx -y bun ${SKILL_DIR}/scripts/check-paste-permissions.tsChecks: Chrome, profile isolation, Bun, Accessibility, clipboard, paste keystroke, Chrome conflicts.
If any check fails, provide fix guidance per item:
| Check | Fix | |
|---|---|---|
| Chrome | Install Chrome or set X_BROWSER_CHROME_PATH env var | |
| Profile dir | Ensure ~/.local/share/x-browser-profile is writable | |
| Bun runtime | `curl -fsSL https://bun.sh/install \ | bash` |
| Accessibility (macOS) | System Settings → Privacy & Security → Accessibility → enable terminal app | |
| Clipboard copy | Ensure Swift/AppKit available (macOS Xcode CLI tools: xcode-select --install) | |
| Paste keystroke (macOS) | Same as Accessibility fix above | |
| Paste keystroke (Linux) | Install xdotool (X11) or ydotool (Wayland) |
references/regular-posts.md for manual workflow, troubleshooting, and technical detailsreferences/articles.md for long-form article publishing guideText + up to 4 images.
npx -y bun ${SKILL_DIR}/scripts/x-browser.ts "Hello!" --image ./photo.pngParameters:
| Parameter | Description |
|---|---|
<text> | Post content (positional) |
--image <path> | Image file (repeatable, max 4) |
--profile <dir> | Custom Chrome profile |
Note: Script opens browser with content filled in. User reviews and publishes manually.
Text + video file.
npx -y bun ${SKILL_DIR}/scripts/x-video.ts "Check this out!" --video ./clip.mp4Parameters:
| Parameter | Description |
|---|---|
<text> | Post content (positional) |
--video <path> | Video file (MP4, MOV, WebM) |
--profile <dir> | Custom Chrome profile |
Note: Script opens browser with content filled in. User reviews and publishes manually.
Limits: Regular 140s max, Premium 60min. Processing: 30-60s.
Quote an existing tweet with comment.
npx -y bun ${SKILL_DIR}/scripts/x-quote.ts https://x.com/user/status/123 "Great insight!"Parameters:
| Parameter | Description |
|---|---|
<tweet-url> | URL to quote (positional) |
<comment> | Comment text (positional, optional) |
--profile <dir> | Custom Chrome profile |
Note: Script opens browser with content filled in. User reviews and publishes manually.
Long-form Markdown articles (requires X Premium).
npx -y bun ${SKILL_DIR}/scripts/x-article.ts article.md
npx -y bun ${SKILL_DIR}/scripts/x-article.ts article.md --cover ./cover.jpgParameters:
| Parameter | Description |
|---|---|
<markdown> | Markdown file (positional) |
--cover <path> | Cover image |
--title <text> | Override title |
Frontmatter: title, cover_image supported in YAML front matter.
Note: Script opens browser with article filled in. User reviews and publishes manually.
If a script fails with Chrome debug port not ready or Unable to connect, kill existing Chrome CDP instances first, then retry:
pkill -f "Chrome.*remote-debugging-port" 2>/dev/null; pkill -f "Chromium.*remote-debugging-port" 2>/dev/null; sleep 2Important: This should be done automatically — when encountering this error, kill Chrome CDP instances and retry the command without asking the user.
Custom configurations via EXTEND.md. See Preferences section for paths and supported options.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.