X Read

Render and summarize a public X (Twitter) link when you need to read the tweet/article content without logging in.

This skill appears coherent and read-only: it scrapes public X pages with Puppeteer and needs no API keys. Before installing, consider: (1) Puppeteer will download a Chromium binary and pull many npm packages—expect a heavier install and network activity. (2) The script launches Chromium with '--no-sandbox' and related flags (common for containerized runs) which reduces process-level sandboxing; run the skill in a hardened environment or sandboxed container. (3) Verify you are comfortable with automated scraping under the target site's terms of service. (4) Review the index.js output and test locally with a few public links to confirm behavior. (5) Do not provide any secrets to the skill (it does not need them). If you want stricter safety, restrict this skill to explicit user invocation only and monitor network egress from the runtime environment.

Type: OpenClaw Skill Name: x-read Version: 1.0.1 The skill's `index.js` uses Puppeteer to launch a Chromium instance with the `--no-sandbox` flag. This critically disables Chromium's security sandbox, creating a significant Remote Code Execution (RCE) vulnerability if a malicious URL is processed. This directly contradicts the `SKILL.md` documentation, which claims a 'sandboxed Chromium instance' is launched. While this is a severe security flaw, there is no evidence of intentional malicious behavior such as data exfiltration, persistence, or unauthorized actions beyond the stated web scraping purpose.