← Back to Skills Marketplace
X Smart Read
by
Aaron McLachlan
· GitHub ↗
· v2.0.4
575
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install x-smart-read
Description
Personal X (Twitter) analytics — timeline engagement, mentions, follower tracking, read any tweet/thread, bookmarks, and combined briefings via X API v2. Cos...
Usage Guidance
This package implements X/Twitter analytics and requires your X API credentials, but the skill metadata incorrectly lists no required environment variables — treat that as a red flag. Before installing: (1) verify the source repository (homepage is missing and owner id is opaque); (2) inspect scripts/x_setup.py to confirm how keys are stored and that they are saved only to ~/.openclaw/skills-config/x-twitter/config.json with restrictive permissions; (3) be cautious about running the 'curl | sh' installer for uv — fetch the script and review it before executing; (4) if you allow an AI agent to invoke skills autonomously, consider restricting it from using --no-budget or --force (or remove those flags) to avoid unexpected API spend; (5) if you plan to install, populate credentials manually and confirm config.json contents, or keep credentials out of env if you prefer an alternate secret store. The overall functionality appears legitimate, but the metadata omission and budget-override flags justify caution (suspicious) rather than outright blocking.
Capability Analysis
Type: OpenClaw Skill
Name: x-smart-read
Version: 2.0.4
The OpenClaw AgentSkills skill bundle for X (Twitter) analytics appears benign. All Python scripts (`x_bookmarks.py`, `x_briefing.py`, `x_common.py`, `x_mentions.py`, `x_read.py`, `x_setup.py`, `x_timeline.py`, `x_user.py`) use the `tweepy` library for X API interactions and manage local data within the skill's designated `~/.openclaw/skills-config/x-twitter/` directory. The `SKILL.md` and `AGENTS.md` files contain extensive instructions for the AI agent, all focused on cost optimization and responsible API usage, with no evidence of prompt injection attempts to subvert the agent's behavior. Credentials are handled securely via `~/.openclaw/.env` or interactive prompts, and `config.json` permissions are set to `0o600`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.
Capability Assessment
Purpose & Capability
The skill's purpose is X (Twitter) analytics and the code and docs clearly require X API credentials (API Key/Secret, Access Token/Secret, Bearer Token) and will store config under ~/.openclaw/skills-config/x-twitter/. However the registry metadata declares no required environment variables or primary credential. That mismatch (declaring 'none' while the scripts and SETUP.md expect and persist five credentials) is a material incoherence and should be resolved before trusting the package.
Instruction Scope
SKILL.md and the scripts are narrowly scoped to calling the X API via tweepy, caching results to a local data directory, and printing summaries. The runtime instructions explicitly warn about costs and include budget guards. Two behavioral notes: (1) the skill provides --force and --no-budget flags that let a caller bypass budget blocking/warnings (so an agent could be instructed to spend freely), and (2) setup imports credentials from ~/.openclaw/.env or prompts interactively and then writes a config.json — this means secrets move onto disk. The scripts do not read unrelated system files or contact unknown external endpoints.
Install Mechanism
There is no formal install spec in the registry (the package is instruction/code-only). The docs instruct users to install 'uv' and show a curl | sh command for uv (https://astral.sh/uv/install.sh). That installer invocation is documented (not executed automatically by the skill) and is a common but higher-risk pattern because it pulls a remote install script. The packaged Python scripts use tweepy and run via 'uv run', which is consistent with the documented workflow.
Credentials
Although the registry lists no required env vars, SETUP.md and the scripts expect and document five X credentials (API Key & Secret, Access Token & Secret, Bearer Token) and a local config file. The skill will store those secrets under ~/.openclaw/skills-config/x-twitter/config.json (SETUP.md says permissions 0600). The omission of these required secrets from metadata is disproportionate and misleading. Also the ability to disable budget checks (--no-budget, --force) increases the risk of unexpected spend if an agent calls the skill autonomously.
Persistence & Privilege
The skill persists data and credentials only under its own directory (~/.openclaw/skills-config/x-twitter/) and the docs state config is saved with restrictive permissions. It does not request always:true and will not be force-included. This is expected for a personal analytics tool. The noteworthy point: stored credentials and cached tweets/mentions/bookmarks are persistent on disk — review config.json and data/ files and ensure filesystem protections meet your security requirements.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install x-smart-read - After installation, invoke the skill by name or use
/x-smart-read - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.4
x-smart-read 2.0.4 changelog:
- Renamed and rebranded as "x-twitter", reflecting X (Twitter) personal analytics focus.
- Expanded documentation with detailed usage guidelines, cost controls, and agent best practices.
- Clarified command usage, workflow examples, and cost-saving strategies.
- Added explicit instructions for budget modes and spend reporting.
- Enhanced trigger and workflow guidance for specific user intents.
Metadata
Frequently Asked Questions
What is X Smart Read?
Personal X (Twitter) analytics — timeline engagement, mentions, follower tracking, read any tweet/thread, bookmarks, and combined briefings via X API v2. Cos... It is an AI Agent Skill for Claude Code / OpenClaw, with 575 downloads so far.
How do I install X Smart Read?
Run "/install x-smart-read" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is X Smart Read free?
Yes, X Smart Read is completely free (open-source). You can download, install and use it at no cost.
Which platforms does X Smart Read support?
X Smart Read is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created X Smart Read?
It is built and maintained by Aaron McLachlan (@nevaaron); the current version is v2.0.4.
More Skills