X Twitter

X (Twitter) API client for searching tweets, retrieving article content, and fetching trending topics. Supports both Bearer Token (app-only) and OAuth 2.0 authentication.

This skill appears to do what it says: three Python scripts that call X's API using a bearer token. Before installing or running: 1) Confirm you are comfortable storing X_BEARER_TOKEN in your environment (anyone with the token can access your app-level API). 2) Note the SKILL.md claim about OAuth 2.0 is not implemented in the scripts — if you need user-auth flows, this package doesn't provide them. 3) Review the scripts (they are short) before running and consider running them in an isolated environment; they only connect to https://api.x.com/2 and optionally write results to files you specify. 4) Be aware some endpoints (trends) may require a paid tier; check your token permissions and rate limits. If you need the skill to support OAuth flows or to avoid storing long-lived tokens in env vars, ask the author for clarification or an updated release.

Type: OpenClaw Skill Name: x-twitter-api Version: 1.0.1 The skill bundle is suspicious due to a path traversal vulnerability in all three Python scripts (`scripts/get_article.py`, `scripts/get_trends.py`, `scripts/search_tweets.py`). The `--save` argument, which allows users to specify an output file, does not sanitize input, potentially allowing an attacker to write arbitrary JSON content to any file on the system where the agent has write permissions (e.g., `../../../../etc/passwd`). There is no evidence of intentional malicious behavior like data exfiltration to external endpoints, backdoors, or prompt injection against the agent.