X Auto-Tweet (Browser)

Automate posting on X by scraping trends, generating and scheduling tweets via browser without API costs, with approval workflows and human-like delays.

This skill mostly does what it claims (uses Playwright to scrape X and post using your browser session), but there are important mismatches and operational risks you should consider before installing: - Missing Telegram integration: SKILL.md/workflow promises sending tweet ideas to Telegram for approval, but there is no Telegram code or credential fields. Expect to implement that yourself or accept that approval will be manual. - Browser privilege: the scripts connect to a local CDP (127.0.0.1:18792) and operate a logged-in browser. Run this only with a dedicated browser profile or isolated VM — do not attach it to your main browser profile that has personal accounts, cookies, or passwords. - Review and test locally first: inspect the scripts (they are small and readable) and run them in a controlled environment. Confirm data is only written to the local data/ directory and that there are no hidden network calls. The code shown does not phone home, but it can perform any action your logged-in browser session allows. - Terms-of-service risk: automating posting may violate X/Twitter ToS. Consider legal/ToS implications for your account. - If you want Telegram approvals, ask the skill author for the missing integration or add it yourself (and only then add the bot token as a credential in a secure way). If you don't want automated posting, keep the approval/manual posting workflow and don't whitelist full automation. Given the documentation/code inconsistencies and the sensitive privilege of controlling a logged-in browser, treat this skill as 'suspicious' until the Telegram/automation gaps are resolved and you run it from an isolated browser/profile.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 7 This skill is classified as suspicious due to its extensive use of browser automation (Playwright) to control the user's logged-in X.com session, as seen in `scripts/*.js`. It also employs clear prompt injection techniques within `SKILL.md`, `WORKFLOW.md`, and `scripts/check-trends.js` to instruct the OpenClaw agent to perform browser actions and communicate via Telegram for tweet approval. While these actions are aligned with the stated purpose of automating X posts, the powerful capabilities of browser control and explicit instructions for external communication (Telegram) represent a significant risk if the agent or skill instructions were compromised, even without clear evidence of intentional malicious behavior in this specific bundle.