OpenClaw X

Control your X/Twitter account — view timeline, search tweets, post, like, retweet, bookmark.

This skill asks you to download and run an unsigned third-party executable and to export your X/Twitter session cookies—doing so hands that binary the ability to act as your account. Before installing: (1) prefer official OAuth/API-key based integrations over exporting cookies; (2) if you must use this, review the executable’s source code or use builds from a verified maintainer and verify checksums/signatures; (3) run the binary in an isolated environment (VM/container) and not on your primary machine; (4) treat cookies.json like a password—store it securely and delete/revoke the session after use; (5) consider alternatives or ask the author for a signed release and clear privacy/security documentation. The static scanner had no files to analyze (instruction-only), so the highest-risk surface here is the external binary and the exported browser cookies.

Type: OpenClaw Skill Name: openclaw-x Version: 0.2.2 The skill bundle is suspicious because it requires the user to download and execute an external, unvetted binary from GitHub (`https://github.com/bosshuman/openclaw-x/releases`). Crucially, it then instructs the user to export their sensitive X/Twitter authentication cookies (`cookies.json`) and provide them to this external executable. This introduces a significant supply chain risk, as the security of the user's X account depends entirely on the trustworthiness of an opaque, external binary whose code is not part of this review. While the `SKILL.md` itself does not contain malicious code or prompt injection attempts, the described setup creates a critical vulnerability for data exfiltration or unauthorized account access if the external binary is compromised or malicious.