twitter-post-aisa

Search, post, like, follow, and engage with Twitter/X content via AISA relay using OAuth-approved API actions with no password sharing.

Key points before installing or running this skill: - Trust the relay: All network calls (including media uploads and OAuth flows) go to https://api.aisa.one — verify you trust that service and its privacy/security practices before providing an AISA_API_KEY or uploading media. - Environment mismatch: The registry summary claims no required env vars/binaries, but SKILL.md and the Python scripts require python3 and AISA_API_KEY. Expect the skill to fail unless you export AISA_API_KEY; treat that value as a secret (Bearer token). - OAuth scope and approvals: The skill will request OAuth authorization to act on your behalf for posting/engagement. Carefully review the OAuth consent screens and granted scopes — revoke access if you see unexpected permissions. - Media handling: If you attach local images/videos, the skill will read the workspace file paths and upload them to the relay as multipart/form-data. Do not upload sensitive files you wouldn't want sent to the relay. - Source provenance: Owner and homepage are unknown/absent. If you need higher assurance, ask the publisher for source provenance (repo, maintainer contact) and confirm the relay operator (aisa.one) is legitimate. - Operational note: Because this skill can post/engage via OAuth, only grant it the minimum permissions you are comfortable with and prefer receiving an authorization URL (do not auto-open the browser) unless you explicitly want local browser flow. If you want help: I can extract the exact places the code reads env vars and the list of endpoints it calls, or draft questions to ask the publisher to improve provenance and metadata before you install.

Type: OpenClaw Skill Name: twitter-post-aisa Version: 1.0.1 The skill bundle provides a legitimate interface for interacting with Twitter/X via the AISA relay API (api.aisa.one). It includes scripts for reading data (twitter_client.py), performing engagement actions like following and liking (twitter_engagement_client.py), and handling OAuth-based posting with media support (twitter_oauth_client.py). The code uses standard Python libraries, lacks obfuscation, and explicitly avoids sensitive local data like browser cookies or passwords, relying instead on a provided AISA_API_KEY. No indicators of data exfiltration, malicious execution, or harmful prompt injection were found.