X Publisher

Post tweets, threads, replies, and quote-tweets to X (Twitter) via API v2 with OAuth 1.0a.

This skill appears to do what it says: it will use the four X/Twitter credentials you provide to act as that account and post/read tweets. Before installing: (1) Only supply credentials for an account you control and are comfortable automating — the script can post, like, and delete as that user. (2) Review the included x-api.js yourself or with someone you trust; there is no hidden outbound host other than api.twitter.com and no obfuscated code, but the script will have network access while it runs. (3) Note the SKILL.md mentions scheduling/cron support, but the code does not implement scheduling — treat that documentation as inaccurate. (4) The skill's source is unknown/third-party; if you do not trust the publisher, create and use a throwaway/test X account or rotate keys after testing. (5) Ensure Node >=18 is available in your environment as required by package.json.

Type: OpenClaw Skill Name: x-leads-api Version: 1.0.0 The skill bundle provides a legitimate Node.js-based CLI tool for interacting with the X (Twitter) API v2. The code in `x-api.js` uses built-in modules to handle OAuth 1.0a authentication and standard API requests without external dependencies or suspicious network calls. While `SKILL.md` contains some functional discrepancies (referencing 'schedule' commands not implemented in the script) and uses restrictive language to guide the AI agent, there is no evidence of malicious intent, data exfiltration, or unauthorized execution.