X Alive

Bring your AI agent to life on X/Twitter. Complete toolkit for launching, growing, and maintaining an authentic AI presence — organic replies, trend awarenes...

This skill is a playbook for running an AI persona on X and is generally coherent with that goal, but it has two red flags you should address before installing: (1) the registry metadata lists no credentials or config paths, while the SKILL.md requires X API keys (OAuth 1.0a credentials and a Bearer token) and instructs putting a Bearer token into ~/.config/env/global.env — verify and prefer a scoped, agent-specific secret store rather than a global file; (2) the skill depends on third‑party tools (xurl, x-research) and links to external repos — review those projects' source and permissions before installing. Also review any local agent files the skill will read (SOUL.md, IDENTITY.md, AGENTS.md) so they don't contain unrelated secrets. If you can't verify xurl/x-research or confirm where tokens will be stored and who can access them, treat this as potentially risky and consider sandbox testing or requiring the skill's manifest to declare required env vars and config paths before use.

Type: OpenClaw Skill Name: x-alive Version: 0.1.0 The skill instructs the AI agent to perform network calls to `api.x.com` (via `curl` and implicitly `xurl`/`x-research`) and to read local files such as `SOUL.md`, `IDENTITY.md`, `AGENTS.md`, and `~/.config/env/global.env` for sensitive tokens. It also relies on external CLI tools and other skills, implying execution of external processes. While these capabilities are necessary for its stated purpose of managing an X/Twitter presence, they introduce potential attack surfaces (e.g., prompt injection to bypass safety instructions or vulnerabilities in dependencies). However, both `SKILL.md` and `README.md` contain explicit and strong safety instructions forbidding data exfiltration, financial scams, and sharing of sensitive information, indicating a clear intent against malicious behavior.