X Bookmarks

Fetch, summarize, and manage X/Twitter bookmarks via bird CLI or X API v2. Use when: (1) user says "check my bookmarks", "what did I bookmark", "bookmark dig...

This package appears to do what it says, but take these precautions before installing: - Source verification: the skill's source/homepage is unknown and the registry metadata contradicts SKILL.md. Only install if you trust the publisher or have reviewed the scripts. - Prefer OAuth over manual cookie copying: use the provided x_api_auth.py flow (OAuth PKCE) rather than manually extracting/pasting auth_token and ct0 — copying cookies is sensitive and error-prone. - Review local storage: tokens are written to ~/.config/x-bookmarks/tokens.json (the code sets 0o600). Make sure you’re comfortable storing tokens on this machine and check file ownership/permissions. - Inspect scripts: the included scripts are small and call only bird or X API endpoints; if unsure, read them yourself or run in an isolated environment (VM/container) first. - Validate bird-cli source: if you use the bird path, ensure you install bird-cli from its official repo/npm package and understand that it accesses browser cookie stores. - Cron/automation: scheduled digests imply storing last-processed IDs in workspace/state — confirm where that state will be stored and secure it if it contains tokens or identifiers. If you want higher assurance, ask the publisher for a verified homepage or run the tools locally (inspect source and run only the Python scripts you reviewed).

Type: OpenClaw Skill Name: x-bookmarks Version: 1.1.0 The skill is classified as suspicious primarily due to a shell injection vulnerability in `scripts/fetch_bookmarks.sh`. The script directly passes unsanitized arguments (`$@`) to the `bird` command via `exec "${CMD[@]}"`, which could allow an attacker to execute arbitrary commands if user input is not properly sanitized by the OpenClaw agent. Additionally, the `SKILL.md` instructs the AI agent to 'propose actions the agent can execute' based on bookmark content, creating a potential prompt injection vector if the agent's sandboxing or input validation is insufficient. While the skill's stated purpose is legitimate and network calls are confined to X/Twitter APIs, these vulnerabilities pose a significant risk.