X Timeline Digest

Build a deduplicated digest from X (Twitter) For You and Following timelines using bird. Outputs a payload for upstream delivery.

This skill appears to do what it says, but check the following before installing: - bird must be installed and already authenticated; bird will access your account timelines using whatever cookies/credentials it already has, so only install if you trust the local bird binary and its auth state. - The skill stores deduplication state at ~/.openclaw/state/x-timeline-digest.json (tweet IDs and timestamps) and keeps IDs ~30 days; if you care about local privacy you may want to inspect or relocate that file. - The script does not call any remote endpoints itself (other than invoking bird); the LLM-based Chinese summarization is expected to be performed by the agent you run (PROMPT.md + digest.json). That means the skill itself doesn't need API keys, but the agent or workflow that does the LLM summarization will — review where you send digest.json and which LLM/API keys you provide. - The implementation uses execFileSync('bird', ...) which is safer than shell execution, but confirm the 'bird' binary on your system is the expected tool and not an unexpected wrapper. - If you want exact behavior matching SKILL.md wording (automatic Chinese digest generation inside the script), note the current script only emits JSON and a simple concatenation; the LLM step is manual/agent-driven. Overall: coherent and low-risk for its purpose; proceed if you trust the local bird installation and the agent/workflow you will use for LLM summarization.

Type: OpenClaw Skill Name: x-timeline-digest Version: 1.0.2 The skill bundle is designed to fetch and process X (Twitter) timelines using an external `bird` binary. The `digest.js` script uses `execFileSync` to invoke `bird` with controlled arguments, mitigating shell injection risks. File system operations are limited to a designated state file (`~/.openclaw/state/x-timeline-digest.json`). Both `SKILL.md` and `PROMPT.md` provide instructions for the OpenClaw agent and an LLM, respectively, but neither contains any malicious prompt injection attempts or directives for unauthorized actions. The overall behavior aligns with the stated purpose of creating a tweet digest without evidence of intentional harmful behavior like data exfiltration or persistence.