X Media Parser

解析 X/Twitter 帖子，获取图片和视频的下载直链。使用 vxtwitter API，无需登录。

This skill's parser appears to do what it claims, but the bundled download helper (x-aria-download.sh) contains surprising hard-coded values: rpc_url set to http://10.0.0.1:6800, secret '88888888', and dir '/mnt/sda1/download/X', and the embedded Python does not use the ARIA2_* environment variables declared earlier. Before installing or running: 1) Inspect the scripts locally (don't run them as root). 2) Ask the author why the aria2 RPC is hard-coded to 10.0.0.1 and why a fixed secret is embedded; request a patch to use ARIA2_RPC_URL, ARIA2_SECRET, and ARIA2_DIR consistently. 3) If you want to use the download helper, either modify the script to point to your aria2 RPC endpoint/secret or run it in a sandboxed environment where network activity to internal hosts is acceptable. 4) Consider using parse.sh alone to obtain direct URLs and handle downloads with tools you control. If the author cannot explain or fix the hard-coded RPC/secret, treat the download helper as untrusted.

Type: OpenClaw Skill Name: x-media-parser Version: 1.0.0 The skill contains hardcoded local network configurations in 'x-aria-download.sh' (IP 10.0.0.1 and secret 88888888) that override the script's own environment variable logic, effectively forcing the agent to communicate with a specific internal network target. While the primary functionality of parsing X/Twitter media via the vxtwitter API in 'parse.sh' appears functional, the discrepancy between the documented configuration and the hardcoded Python logic is a significant red flag for unauthorized local RPC interaction.