Tweet Summarizer Lite

Fetch and summarize single tweets from Twitter/X. Basic search and single tweet fetching. Lightweight version perfect for quick tweet lookups.

Before installing or running this skill: - Confirm the source: the registry metadata you provided lacks required env and binary declarations, while the bundled SKILL.md/package.json/scripts do require AUTH_TOKEN, CT0, and the 'bird' CLI. Ask the publisher to explain the mismatch or install from the official repo URL (verify commit history and publisher identity). - Treat AUTH_TOKEN and CT0 as highly sensitive session cookies. Prefer using a throwaway/dedicated account for scraping. Do not paste your primary account cookies into third-party tools unless you trust them. - Verify the 'bird' CLI: inspect its source or install from a trusted release. The Python code shown here does not exfiltrate tokens itself, but the bird binary will perform network requests using those cookies—so bird's trustworthiness matters. - Fix/document path inconsistencies: the scripts save to ~/.openclaw/.../data/tweets-lite while README/SKILL.md mention different paths. Confirm where your data and any config files will be written before running. - If you proceed, do not commit cookies or the data folder to version control; rotate cookies if you suspect compromise. If you need help verifying the bird binary or want me to flag exact lines of concern in the code, I can do a deeper review. Clarifying the metadata mismatches (registry vs SKILL.md/package.json) would raise confidence.

Type: OpenClaw Skill Name: tweet-summarizer-lite Version: 1.0.2 The skill's functionality aligns with its stated purpose of fetching and summarizing tweets, which inherently requires access to Twitter via user-provided session cookies (`AUTH_TOKEN`, `CT0`). These sensitive credentials are handled via environment variables, a recommended practice, and are explicitly documented in `SKILL.md`, `README.md`, and a comprehensive `SECURITY.md`. The `SECURITY.md` file is particularly strong, detailing risks, best practices, and explicitly stating 'No data exfiltration' and 'No credential logging'. The code uses `subprocess.run` to execute the `bird` CLI, passing arguments and environment variables, which is a legitimate use for its function. There is no evidence of obfuscation, unauthorized data exfiltration, persistence mechanisms, or prompt injection attempts against the agent. The local storage of tweets is within the designated workspace.