{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-post-to-x",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Invocation of undocumented or reverse-engineered private APIs / client fingerprint spoofing"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Techniques to bypass anti-automation detection, disable host sandboxes, or ignore SSL certificate verification"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reading or reusing browser user authentication states and session cookies"
    },
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reading user login cookies/sessions/keyrings: CDP Network.getCookies reads session cookies for x.com / twitter.com and asserts auth_token and ct0"
    },
    {
      "file": "scripts/",
      "summary": "Executing local scripts or commands: ${BUN_X} {baseDir}/scripts/x-browser.ts|x-video.ts|x-quote.ts|x-article.ts"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: https://x.com/compose/post and https://x.com/compose/articles (real browser navigation)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: $TMPDIR/x-article-content.html (long-form article HTML) and $TMPDIR/x-article-images (temporary directory for article images)"
    }
  ],
  "verification": {
    "method": "第一遍：本人通读 SKILL.md（335 行，含模式选择/三种执行路径/各类型发布流程/预检/偏好），并读 references/regular-posts.md 与 articles.md。第二遍：独立只读 scout 逐文件核对 10 个脚本的 spawn/写盘/CDP 调用、核对 cookie 面的准确边界（是否读 Cookies 文件）、核对预检脚本的 7 项检查与两个单测的网络面；构建脚本对每条 evidence.quote 做空白归一化逐字断言。",
    "second_pass": [
      {
        "item": "反自动化侦测的绕过（判红主因）",
        "status": "ok",
        "detail": "README 'bypass anti-automation' + regular-posts.md 的 Cmd+V/合成事件两段 + paste-from-clipboard.ts 顶部注释互相印证；x-browser.ts 里 pasteFromClipboard('Google Chrome', 5, 500) 为首选，CDP 键事件为 fallback。"
      },
      {
        "item": "cookie 面边界：只经 CDP 读、不落盘",
        "status": "ok",
        "detail": "x-utils.ts 经 Network.getCookies 取 x.com/twitter.com cookie 并在内存构建 map，仅断言 auth_token/ct0 存在；全目录 grep 未发现写入 cookie 文件或读取 Cookies SQLite（'Cookies' 只出现在单测字面量里）。"
      },
      {
        "item": "接管已运行调试会话",
        "status": "ok",
        "detail": "packages/baoyu-chrome-cdp 通过 ps aux 匹配 profileDir + --remote-debugging-port 找端口并连接；x-utils.ts 也自行 spawnSync('ps', ['aux']) 做占用判定。"
      },
      {
        "item": "发布动作默认关闭",
        "status": "ok",
        "detail": "tweetButton/publishButton 的 click 都包在 --submit 分支内；未提交时脚本打印提示让用户自己在浏览器点发布；SKILL.md 另有『必须当轮明确确认』的硬规则。"
      },
      {
        "item": "进程级动作（pkill）",
        "status": "ok",
        "detail": "SKILL.md 第 321 行给出 pkill -f \"Chrome.*remote-debugging-port\" …; sleep 2 的清理配方；该命令不在任何 TS 脚本内，需由 agent 执行——已写入 security.scripts_executed 与 risks。"
      },
      {
        "item": "文档与实现不一致（--disable-blink-features）",
        "status": "discrepancy",
        "detail": "references/regular-posts.md 宣称 CDP 路线会用 --disable-blink-features=AutomationControlled 启动 Chrome，但 x-utils.ts 只传 extraArgs: ['--start-maximized']；该参数仅出现在 packages/baoyu-chrome-cdp/src/mermaid.ts 的无头渲染启动里。故『绕过』的实际手段是真实键击 + 真实浏览器，而非该启动参数。"
      },
      {
        "item": "单测是否触碰网络/浏览器",
        "status": "ok",
        "detail": "x-utils.test.ts 与 md-to-html.test.ts 均为纯函数/临时目录测试（锁文件判定、启动重试判定、cookie map、markdown 解析），无网络、无 Chrome 启动。"
      },
      {
        "item": "档位复核（批4 终裁）",
        "status": "ok",
        "detail": "按 Main 终裁与范式红档『反反爬/绕过』字面命中判 red（撤回先前的 orange）；同时保留可减轻情节的说明：无 TLS/沙箱降级、无未转义插值、cookie 不落盘、发布默认关闭。"
      },
      {
        "item": "元数据与 pin",
        "status": "ok",
        "detail": "本地 HEAD = 1567581c26ec29f4216c6e6835415bf30343b0e3（2026-09-10 10:13:43 -0500）；GitHub API MIT / 25926 stars / pushed_at 2026-09-10T15:13:43Z；仓库根 LICENSE 为 MIT。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "83fb7a73416e3fe395e768b35289894be36bd1297a9e4de81f030685bd6a3eb0",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-post-to-x.tar.gz",
    "sha256": "83fb7a73416e3fe395e768b35289894be36bd1297a9e4de81f030685bd6a3eb0",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-post-to-x",
    "path": "skills/baoyu-post-to-x",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}