← Back to Skills Marketplace
Twitter Automation
by
Ömer Karışman
· GitHub ↗
· v0.1.5
2287
Downloads
2
Stars
20
Active Installs
2
Versions
Install in OpenClaw
/install twitter-automation
Description
Automate Twitter/X with posting, engagement, and user management via inference.sh CLI. Apps: x/post-tweet, x/post-create (with media), x/post-like, x/post-re...
Usage Guidance
This skill appears to do what it says (Twitter/X automation via the inference.sh CLI), but take precautions before installing: 1) Do not blindly run curl | sh — instead download the installer, inspect the script, and verify the SHA-256 checksums against the checksums.txt over HTTPS. 2) Confirm the legitimacy of inference.sh/dist.inference.sh (who operates them, repo, release signatures) before trusting binaries from that domain. 3) Understand what 'infsh login' does: what credentials it requests, where tokens are stored, and whether the CLI will forward your Twitter/X credentials to a third party. 4) Test with a throwaway or restricted account first, since automated likes/DMs/follows can violate platform TOS and risk account suspension. 5) If you want lower risk, prefer vendor-distributed packages on trusted registries or build from source and verify signatures; request the skill author include an explicit install spec or vetted package link. If you need help analyzing the installer script or the CLI's auth flow, provide the script or the relevant docs and I can review them.
Capability Analysis
Type: OpenClaw Skill
Name: twitter-automation
Version: 0.1.5
The `SKILL.md` file contains instructions that, if followed by the OpenClaw agent, would bypass its declared security policy (`allowed-tools: Bash(infsh *)`). Specifically, the 'Quick Start' section instructs the agent to execute `curl -fsSL https://cli.inference.sh | sh` and the 'Related Skills' section instructs `npx skills add ...`. Both `curl | sh` and `npx` commands do not start with `infsh`, representing a prompt injection vulnerability that could lead to arbitrary remote code execution (RCE) and supply chain risks if the remote scripts or npm packages are compromised. While the stated purpose of these commands is installation and adding related skills, the method used introduces significant security vulnerabilities.
Capability Assessment
Purpose & Capability
Name, description, and runtime instructions align: the SKILL.md consistently describes using the inference.sh CLI to post, like, retweet, DM, follow, and query X/Twitter. The actions and example commands map to the stated purpose. No unrelated services or credentials are requested in the manifest.
Instruction Scope
The instructions stay within the scope of social automation (install CLI, run infsh app run <app> with JSON inputs). They do instruct 'infsh login' which implies creating/storing authentication tokens via the CLI, but they do not instruct reading arbitrary local files or exfiltrating data. However, the SKILL.md also references other platform apps (image/video generation) which may require their own credentials or external uploads; that increases the attack surface if you follow those workflows.
Install Mechanism
There is no install spec in the registry; instead SKILL.md suggests piping a remote install script (curl -fsSL https://cli.inference.sh | sh) that downloads a binary from dist.inference.sh. That is a high-risk install pattern: it pulls and runs code from a third-party domain rather than a well-known package host. The doc claims SHA-256 checksums are available, but verification is manual and depends on the user trusting the distribution site and TLS chain. This is the main security concern.
Credentials
The registry declares no required environment variables or primary credential, but the runtime requires 'infsh login' (i.e., the CLI will obtain and store auth tokens). That is reasonable for a social media automation tool, but it's not explicit in the manifest—so you should verify what credentials/tokens the CLI requests, where it stores them, and whether it requires OAuth/API keys for X/Twitter or proxies them through inference.sh.
Persistence & Privilege
The skill does not request always:true and has no install spec in the registry that would force persistent system presence. The CLI login will likely store tokens/config in the user's home directory (expected behaviour) but the skill itself doesn't declare system-wide privileges or modify other skills.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install twitter-automation - After installation, invoke the skill by name or use
/twitter-automation - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.5
- Expanded documentation with detailed CLI usage examples for posting, engagement, and user management on Twitter/X.
- Clarified available apps and their usage, including new examples for posting media, liking, retweeting, DMs, following users, and more.
- Added workflow examples to automate posting of AI-generated images and videos.
- Provided installation, security notes, and links to related skills and platform documentation.
v0.1.0
Initial release – automate Twitter/X actions using inference.sh CLI.
- Supports posting tweets (text & media), liking, retweeting, sending DMs, following users, and profile lookups.
- Provides CLI command examples for each action.
- Includes sample workflows for generating AI images/videos and posting them.
- Links to documentation and related automation skills for extended functionality.
Metadata
Frequently Asked Questions
What is Twitter Automation?
Automate Twitter/X with posting, engagement, and user management via inference.sh CLI. Apps: x/post-tweet, x/post-create (with media), x/post-like, x/post-re... It is an AI Agent Skill for Claude Code / OpenClaw, with 2287 downloads so far.
How do I install Twitter Automation?
Run "/install twitter-automation" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Twitter Automation free?
Yes, Twitter Automation is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Twitter Automation support?
Twitter Automation is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Twitter Automation?
It is built and maintained by Ömer Karışman (@okaris); the current version is v0.1.5.
More Skills