Home / All Skills / Content & Media Creation / canghe-post-to-x
English (EN)简体中文 (ZH)日本語 (JA)
Content & Media Creation · freestylefly/canghe-skills

canghe-post-to-x

Posts content and articles to X (Twitter). Supports regular posts with images/videos and X Articles (long-form Markdown). Uses real Chrome with CDP to bypass anti-automation. Use when user asks to "post to X", "tweet", "publish to Twitter", or "share on X".

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedTerms / ComplianceCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit
Author freestyleflyGitHub freestylefly/canghe-skills ↗License MIT（仓库根 LICENSE）Commit dd0bf35595
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

Instead of Playwright/Puppeteer, it drives a real Chrome instance via CDP to populate content into the actual X UI, with the official description explicitly stating the goal is to bypass anti-automation detection.

skills/canghe-post-to-x/SKILL.md
Posts text, images, videos, and long-form articles to X via real Chrome browser (bypasses anti-bot detection).
What it is doing: The opening sentence of SKILL.md explicitly sets the architectural rationale; the implementation relies on a persistent profile in real Chrome + a CDP session.

Four content types (regular posts/video posts/quotes/articles) share the same Chrome/CDP infrastructure and clipboard subsystem.

skills/canghe-post-to-x/SKILL.md
| `scripts/x-video.ts` | Video posts (text + video) |
What it is doing: The Script Reference table lists each entry-point script; each script launches real Chrome individually with a consistent parameter schema.

Key bypass technique: Instead of CDP synthetic key events, it uses osascript to emit real Cmd+V keystrokes because X detects and ignores synthetic events.

skills/canghe-post-to-x/references/regular-posts.md
Sends real Cmd+V keystroke to Chrome, bypassing CDP's synthetic events that X can detect
What it is doing: The Image Paste Mechanism section explains that CDP synthetic keyboard events can be identified by the website, so it switches to system-level real keystrokes.

Startup flags proactively disable automation feature indicators.

skills/canghe-post-to-x/scripts/x-browser.ts
'--disable-blink-features=AutomationControlled',
What it is doing: All four scripts (x-article, x-browser, x-quote, and x-video) include this flag to eliminate traces like navigator.webdriver.

Articles workflow: md-to-html.ts parses frontmatter/cover image and replaces body images with XIMGPH_n placeholders, while x-article.ts populates the editor via CDP and then reverses placeholders to insert images.

skills/canghe-post-to-x/references/articles.md
"placeholder": "XIMGPH_1",
What it is doing: Placeholders + sequential locate-and-replace serve as a workaround when the X Articles editor does not accept pasted images from the clipboard.

Cross-platform clipboard/keystroke subsystem: uses xdotool/ydotool on Linux, osascript on macOS, and PowerShell SendKeys on Windows.

skills/canghe-post-to-x/scripts/paste-from-clipboard.ts
{ cmd: 'xdotool', args: ['key', 'ctrl+v'] },
What it is doing: paste() dispatches based on process.platform; images are first written to the system clipboard via copy-to-clipboard.ts (using inline Swift on macOS).

Defaults to populating without publishing: the script stops after filling in content to wait for manual review; articles only actually publish when --submit is specified.

skills/canghe-post-to-x/references/articles.md
10. **Publish**: Only with `--submit` flag
What it is doing: Steps 9–10 of Workflow explicitly state that the browser remains open for preview, and publishing requires an explicit --submit.

Precheck script verifies Chrome, profile isolation, Bun, accessibility permissions, clipboard, paste keys, and conflicts with Chrome.

skills/canghe-post-to-x/SKILL.md
Checks: Chrome, profile isolation, Bun, Accessibility, clipboard, paste keystroke, Chrome conflicts.
What it is doing: check-paste-permissions.ts acts as an optional pre-flight diagnostic, offering step-by-step remediation guidance upon failure.

First-time run requires manual login, with session persisted to the profile.

skills/canghe-post-to-x/SKILL.md
- First run: log in to X manually (session saved)
What it is doing: Prerequisites/Notes explain that a persistent profile is used to retain login state, which subsequent scripts reuse.

2Core Capabilities

01Publish regular posts (text + up to 4 images)
02Publish video posts (MP4/MOV/WebM)
03Quote post with added commentary
04Publish long-form X Articles (Markdown, requires X Premium)
05Convert Markdown → HTML (including cover images and body image placeholders)
06Simulate real keystroke pasting (bypassing detectable CDP synthetic events)
07Cross-platform clipboard/keystroke adaptation (macOS/Linux/Windows)
08Environment precheck (Chrome/permissions/clipboard/keystrokes/conflicts) and default manual review before publishing

3External Dependencies

KindDependency / Endpoint
networkX 编辑器页面（浏览器端访问）
clibun（经 npx -y 即时拉取）
cliGoogle Chrome / Chromium（CDP）
cli真实键击工具：osascript / xdotool / ydotool / powershell.exe
packagemarked / highlight.js / front-matter / remark-*（md 转换）
mcpPlaywright MCP（可选的手工工作流示例调用）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
  • SKILL.md / 脚本参数: Includes bypassing automation detection, disabling host sandbox, or skipping SSL certificate verification
  • SKILL.md / 会话存储: Reads or reuses browser user login state and session cookies
  • scripts/: Executes local scripts or commands: npx -y bun ${SKILL_DIR}/scripts/x-browser.ts / x-video.ts / x-quote.ts / x-
  • 网络端点: Declares external network access: CDP port discovery http://127.0.0.1:<port>/json/version and WebSocket connection to CDP (x-utils.ts
  • 本地工作目录: File read/write and artifact output: Chrome profile directory (configurable via X_BROWSER_CHROME_PATH / profile arguments)
Audit Notes: (Capability/policy-level assessment, not malicious code injection). Flagged red solely due to technical bypass of anti-automation detection: SKILL.md explicitly states 'bypasses anti-bot detection'; regular-posts.md explains why real Cmd+V is used ('bypassing CDP'\''s synthetic events that X can detect') and explicitly notes 'This approach bypasses X'\''s anti-automation detection that blocks Playwright/Puppeteer.'; all four scripts (x-article/x-browser/x-quote/x-video) include --disable-blink-features=AutomationControlled. Credential aspect involves sharing the logged-in X session of a Chrome profile; --submit permanently publishes content under the user's account. No credential file harvesting, no TLS/sandbox downgrades, and no obfuscation exist, so the red rating is solely based on the bypass vector, belonging to the same family as baoyu-post-to-x (precedents: notebooklm-skill, baoyu-post-to-x).

5Second-Pass Verification

  • [ok] 反自动化绕过动机 — SKILL.md 描述、regular-posts.md 的 How It Works 与 paste-from-clipboard.ts 顶部注释三处一致声明绕过检测。
  • [ok] AutomationControlled 标志 — 风险扫描在 x-article.ts:117 / x-browser.ts:44 / x-quote.ts:48 / x-video.ts:48 四处定位同一参数，判红据成立。
  • [ok] 四条内容路径 — SKILL.md Script Reference 与各命令行示例互证 x-browser/x-video/x-quote/x-article 四个入口。
  • [ok] 剪贴板/键击跨平台适配 — paste-from-clipboard.ts 正文完整展开，pasteMac/pasteLinux/pasteWindows 分派逐字可核。
  • [ok] 长文占位符机制 — articles.md 的 images XIMGPH_n 与 Workflow 第 8 步『反向替换』描述自洽。
  • [ok] 凭证读取 — 「凭证/环境变量」39 条命中均为 ${SKILL_DIR}/$HOME/profile 参数与示例，未见密钥/cookie 文件读取；凭据即 profile 登录态，与结论一致。
  • [unlocatable] 主脚本的 CDP DOM 细节 — x-browser/x-video/x-quote/x-article.ts 全文未在 bundle 展开，文本注入与 DOM 操作细节以 SKILL.md/references 描述与扫描行为据，未代码级复核。
  • [ok] Playwright MCP 引用 — 仅出现在 regular-posts.md 的可选手工工作流示例，非脚本内置依赖，不改变档位。

6Verdict & Scenarios

  • Covers all four publishing formats on X (regular posts/videos/quotes/articles) within a self-contained skill.
  • Does not publish automatically by default: fills content and remains in preview mode; publishing requires explicit --submit.
  • Comprehensive cross-platform clipboard/keystroke subsystem complete with environment prechecks and remediation guidance.
    • Best for: Content creators who need to publish text, images, videos, or long-form articles to X and accept semi-automated operations using an authenticated real browser session.
    Not for: Scenarios requiring strict compliance without bypassing platform anti-automation detection; environments where users are unwilling to reuse a logged-in real Chrome profile or grant accessibility permissions.
    Install Agent-Ready
    ① Verified Mirror 2026-10-10
    Option A · Direct DownloadDownload canghe-post-to-x.tar.gz
    sha256: aa885729a2c33e40…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit dd0bf35595.