← back to baoyu-post-to-x

Skill Scanner · baoyu-post-to-x

independent scanner by Cisco AI Defense · skill by ECNU-ICALK · how it works ↗

FAILmax severity: CRITICAL

Skill does not specify a license; Node.js child_process module usage for shell command execution; Node.js filesystem access that could read or write sensitive data; +1 more

scanned 2026-08-22

Findings (20)

INFOpolicy_violation

Skill does not specify a license

SKILL.md

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:69

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:117

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:138

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:151

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:166

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:167

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:181

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\check-paste-permissions.ts:192

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\copy-to-clipboard.ts:115

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\md-to-html.ts:282

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\paste-from-clipboard.ts:54

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\paste-from-clipboard.ts:77

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\paste-from-clipboard.ts:103

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\paste-from-clipboard.ts:107

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\paste-from-clipboard.ts:130

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\x-article.ts:69

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\x-article.ts:345

MEDIUMdata_exfiltration

Outbound network request primitives in JavaScript/TypeScript

scripts\x-utils.ts:102

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\x-utils.ts:224

What the verdicts mean

Skill Scanner reports on SkillMD's shared five-tier scale. See how Skill Scanner works ↗.

PASS

Reported as safe — no findings

CAUTION

Findings up to MEDIUM severity

WARNING

Findings of HIGH severity

FAILthis skill

Findings of CRITICAL severity

INCONCLUSIVE

Scan could not complete