Security Audit

jimliu/baoyu-skills:skills/baoyu-post-to-x

github.com/jimliu/baoyu-skills

AI SkillCommit 6b7a2e417500

CAUTION

Scanned 24 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

jimliu/baoyu-skills:skills/baoyu-post-to-x received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Sensitive environment variable access: $HOME, Unpinned npm dependency version, Node lockfile missing.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on August 6, 2026 (commit 6b7a2e41). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

93%

Dependency Graph

91%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Filesystem Write

1 finding

Shell Execution

2 findings

Dynamic Code

1 finding

Excessive Permissions

1 finding

Security Findings4

Severity	Finding	Layer	Location
HIGH	AppleScript Injection in paste-from-clipboard.ts The script `paste-from-clipboard.ts` accepts a user-controlled `--app` argument and directly interpolates it into an AppleScript string executed via `osascript`. An attacker can exploit this by providing a crafted application name containing double quotes and AppleScript commands (e.g., using `do shell script`), leading to arbitrary command execution on macOS. Sanitize the `targetApp` / `appName` input to ensure it only contains alphanumeric characters and spaces, or escape double quotes and backslashes before interpolating them into the AppleScript template.	LLM	scripts/paste-from-clipboard.ts:51
MEDIUM	Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated.	Static	skills/baoyu-post-to-x/SKILL.md:92
MEDIUM	Unpinned npm dependency version Dependency 'baoyu-chrome-cdp' is not pinned to an exact version ('^0.1.1'). Pin dependencies to exact versions to reduce drift and supply-chain risk.	Dependencies	skills/baoyu-post-to-x/scripts/package.json
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/baoyu-post-to-x/scripts/package.json

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/057d5901ca63f601.svg)](https://skillshield.io/report/057d5901ca63f601)