X/Twitter by altf1be

Post tweets, threads, and media to X/Twitter via API v2 — secure OAuth 1.0a signing, minimal dependencies (commander + dotenv only).

This skill appears to do exactly what it claims: post tweets/threads and upload media using your X/Twitter OAuth keys. Before installing: (1) Verify you trust the skill source (GitHub link in metadata). (2) Keep the four OAuth secrets private (store in .env, do not commit). (3) Run npm install in an isolated environment if you are cautious — package-lock.json is present and shows only 'commander' and 'dotenv'. (4) Note the script will read media files you explicitly pass; it enforces path and extension checks (only under home/working-dir/tmp and common image/video extensions). (5) The README mentions a Bearer Token but the code does not use one — expect only OAuth consumer/access keys. Rotate keys if you later revoke access. If you want additional assurance, review the full scripts/xpost.mjs file before running and test with a throwaway/test account first.

Type: OpenClaw Skill Name: x-twitter-by-altf1be Version: 1.1.3 The skill provides a well-structured CLI for interacting with the X (Twitter) API v2. The implementation in `scripts/xpost.mjs` includes proactive security measures, such as a `validateFilePath` function that prevents Local File Inclusion (LFI) by restricting file access to specific allowed directories and blocking sensitive paths like `.ssh`, `.env`, and `/etc/`. It uses standard OAuth 1.0a signing via built-in Node.js crypto modules and maintains a minimal dependency footprint (only `commander` and `dotenv`).