readx

Twitter/X intelligence toolkit: analyze users, tweets, trends, communities, and networks

This skill appears to do what it says: it calls a remote readx.cc service and needs an API key. Before installing, verify you trust readx.cc (it's the only network endpoint used). Prefer storing the API key in a secure place (environment variable or credential store) rather than embedding it into URLs or plaintext files. If asked, decline having the agent itself write credentials to your config unless you trust the skill and know exactly where and how the key will be stored. Avoid pasting the API key into public logs or chat. If you want stronger assurance, ask the vendor for documentation, a privacy policy, and whether the MCP URL can be configured without the API key in the query string (e.g., via a secure header or token store).

Type: OpenClaw Skill Name: readx Version: 1.1.4 The skill is classified as suspicious due to instructions for the AI agent to perform file system read/write operations and shell execution, which are high-risk capabilities. Specifically, `SKILL.md` instructs the agent to read and potentially write an API key to `~/.config/readx/credentials.json` (or Windows equivalent) and to execute `curl` commands for API interaction and fetching API documentation from `https://readx.cc`. While these actions are plausibly needed for the skill's stated purpose and `SKILL.md` includes explicit safeguards against API key exfiltration to unauthorized domains, these capabilities introduce an attack surface for potential vulnerabilities (e.g., shell injection, arbitrary file access) if the agent's execution environment or input sanitization is flawed.