js-x-ops-skill SKILL.md skillB
js-x-ops-skill from imjszhang/js-eyes is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add imjszhang/js-eyes/js-x-ops-skill@v3.5.0Pins v3.5.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- imjszhang/js-eyes
- Path
skills/js-x-ops-skill/SKILL.md- Versions recorded
- 5
- Latest version
- v3.5.0, committed Aug 5, 2026
- First version recorded
- Jul 18, 2026
- Size
- 39,964 bytes
- Repository stars
- 45
- License
- MIT
X.com (Twitter) 内容只读 + 浏览器导航 + 账号监控 skill：搜索 / 用户主页 / 推文详情 / 首页 Feed 走 X.com 内部 GraphQL 同源端点（DOM 兜底），浏览器侧仅 location.assign 改 URL；内置 monitor 子系统做定时监控 + webhook 通知；写操作（reply/post/quote/thread）保持 v2.0.1 透传，v3.1 将拆到专用工具。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# js-x-ops-skill 面向 x.com / twitter.com 的 skill。v3.0 起切到 `PAGE_PROFILES + Bridges + Session` 架构，参考 `js-reddit-ops-skill` 的设计取舍： - **数据获取**：READ 数据优先走 X.com 内部 GraphQL 同源端点（`/i/api/graphql/<queryId>/<op>`），与浏览器同源、复用 cookie + bearer；DOM 解析（`bridges/common.js::parseTweetArticle`）保留为兜底 - **safety 分级**：READ + INTERACTIVE 已经落地；DESTRUCTIVE（reply / post / quote / thread）目前透传 v2.0.1 的 `scripts/x-post.js`，**v3.1 拆 compose-bridge 后将走 `--confirm` + 默认 `--dry-run`** ## 依赖与前置 - Node.js 22+、JS Eyes 2.8.5+；**JS Eyes Server** 已启动（`js-eyes server start`） - **浏览器扩展**：已安装并连上 server - **登录态**：浏览器里已经人工登录 x.com（本 skill 不做任何登录自动化）；READ 工具默认 `navigateOnReuse=false / reuseAnyXTab=true`，bridge 在任意 x.com / twitter.com tab 里 fetch 同源 GraphQL；用户当前 tab 不会被切走 - **Raw Eval**：bridge 首次注入需要宿主设置 `security.allowRawEval: true`；JS Eyes 2.5+ 会把该设置同步到扩展，扩展存储中的显式 `false` 仍可强制关闭 - **Chrome**：要求 135+；Chrome 138+ 还需开启浏览器控制的 **Allow User Scripts** ## 安全红线（READ / INTERACTIVE / DESTRUCTIVE） 本 skill 的所有工具都会被归入以下三档之一。审计界线按「是否改 X 业务数据」而非「是否触网」来划： ### READ（默认档） 纯读，不改任何 DOM、不改 URL、不触发任何业务写操作。 - 走 `fetchXGraphQL(opName, vars, features)` 调 X.com 内部 GraphQL（GET，复用浏览器同源 cookie + 写死 bearer） …
Read the whole file at its exact version.
How to install
mdr add imjszhang/js-eyes/js-x-ops-skill@sha256:086dad52752c5170The line at the top of this page pins the label v3.5.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_hphh7ccm2yop36es)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Jul 18, 2026 and Aug 5, 2026, about one every 5 days. Its first recorded version is graded A and its latest B.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v3.5.0 latest | 2026-08-05 | 0735556 | 39,964 B | B | view · diff |
| v3.5.0 | 2026-08-03 | f5e9936 | 38,536 B | A | view · diff |
| v3.5.0 | 2026-07-26 | 2d8e74d | 38,604 B | A | view · diff |
| v3.5.0 | 2026-07-25 | 024f9ee | 38,601 B | A | view · diff |
| v3.5.0 | 2026-07-18 | b35aab3 | 38,642 B | A | view |
Audit of the latest version
- fail: No link to a raw IP address (matched: http://127.0.0.1:7890)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (39964 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
imjszhang/js-eyes · 45 stars · license MIT · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_hphh7ccm2yop36es GET https://markdownregistry.com/api/v1/resolve?ref=imjszhang/js-eyes/js-x-ops-skill GET https://markdownregistry.com/api/v1/blob/086dad52752c51709b43a1b6a600d525e218e4f812f3800a1da0dd7888eedb2e
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.