X Posting — Automated Twitter/X Agent

Automate posting, replying, searching, and timeline reading on X (Twitter) using the bird CLI with configured Chrome profile and content strategy.

This skill is coherent with its purpose, but it relies on the bird-cli reading your Chrome profile/cookies to authenticate — that gives the tool the ability to post as your account. Before installing: (1) verify the bird-cli package/source (npm or Homebrew) is legitimate and reviewed; (2) consider creating and using a dedicated Chrome profile for automation so your main browsing cookies/credentials are isolated; (3) keep skills/x-posting/config.json and the chrome_profile_path private and with limited file permissions; (4) monitor account activity and be ready to revoke sessions or change your account login if you stop using the tool; (5) if you’re uncomfortable giving any tool access to your browser cookies, do not install/use this skill. If you want a stronger assurance, request the bird-cli project homepage or repository and inspect it before installing.

Type: OpenClaw Skill Name: x-posting-skill Version: 1.0.0 The skill requires access to the user's Chrome profile directory to extract session cookies for X (Twitter) authentication, which is a high-risk permission that exposes sensitive browser data (SKILL.md). It also instructs the agent to install an external global NPM package ('bird-cli') to perform these actions. While these steps are plausibly needed for the stated purpose of automated posting, the combination of browser data access and the execution of a non-standard third-party binary poses a significant security risk.