Twitter Video Download

Download videos from Twitter/X posts. Just give it a tweet URL and it will download the video to your specified location.

This skill appears to implement the advertised feature, but there are a couple of mismatches you should address before installing or running it: - The Node script (download.mjs) requires Node to run, but the registry metadata does not declare node as a required binary. Ensure your environment provides Node (node/npm) or ask the author to update the metadata. - The manifest marks PROXY_URL as required, but the script treats it as optional (used only when set). Only set PROXY_URL if you need a proxy; avoid placing credentials in that variable unless you trust the source and understand where that proxy forwards traffic. - The skill spawns the yt-dlp executable to download remote media. yt-dlp will perform network requests to Twitter/X and possibly third-party hosts (CDNs). Only use this skill if you trust the author and the yt-dlp package you install (pip install yt-dlp from PyPI). Consider installing yt-dlp in a controlled environment (virtualenv) first. Recommended actions: 1) Request the author or maintainer to add 'node' to required binaries or provide a pure-Python implementation. 2) Ask them to mark PROXY_URL as optional in registry metadata so it isn't treated as mandatory. 3) Review the Node script locally (it is included) and test in a VM or isolated environment before giving it broad access to your filesystem. 4) If you must use a proxy, avoid embedding sensitive credentials in PROXY_URL unless necessary; prefer a local proxy or secure credential handling. Given these inconsistencies, treat the package with caution until the metadata and documentation are aligned with the actual runtime requirements.

Type: OpenClaw Skill Name: twitter-video-download Version: 1.0.2 The skill is a legitimate utility for downloading Twitter/X videos using the well-known yt-dlp library. The implementation in `scripts/download.mjs` follows security best practices by using `child_process.spawn` with `shell: false` to prevent command injection, validating URLs against a whitelist (twitter.com/x.com), and sanitizing filenames to prevent path traversal. No evidence of data exfiltration, malicious execution, or prompt injection was found.