← Back to Skills Marketplace
X Extract
by
Chunhua Liao
· GitHub ↗
· v1.0.0
796
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install x-extract
Description
Extract tweet content from x.com URLs without credentials using browser automation. Use when user asks to "extract tweet", "download x.com link", "get tweet...
Usage Guidance
This skill is internally consistent for scraping public x.com/twitter.com tweet pages via the platform browser tool and does not request credentials. Before installing, consider: 1) Media download option uses shell tools (curl/wget) to fetch and write remote URLs — only download media you trust and be mindful of disk storage and copyright. 2) Excessive automated requests may trigger X.com rate-limiting or IP blocking. 3) The included helper script is primarily an instructions writer (it prints snapshot instructions) and has a minor mismatch: SKILL.md supports both x.com and twitter.com but the script currently checks only for 'x.com'. If you require twitter.com domain support, review/adjust the code. 4) Ensure your OpenClaw agent’s browser tool access is intentional, since the skill relies on that tool to load pages. If you need higher assurance, review the script and selectors file line-by-line before enabling downloads or granting the agent broad autonomous access.
Capability Analysis
Type: OpenClaw Skill
Name: x-extract
Version: 1.0.0
The skill is suspicious due to a potential shell injection vulnerability in `SKILL.md`. The instructions for the AI agent explicitly use `exec` with `curl` to download media, constructing a shell command with `<media-url>` directly from an external source (x.com). If a malicious actor could control the content of `<media-url>` (e.g., by posting a tweet with a specially crafted URL containing shell metacharacters), this could lead to arbitrary command execution on the agent's host. This is a high-risk vulnerability, even if the stated purpose of downloading media is benign.
Capability Assessment
Purpose & Capability
The name/description (extract tweets via browser automation) matches the provided SKILL.md, selectors reference, and the included script. No unrelated credentials, binaries, or config paths are requested. The skill's features (text, author, timestamp, media, engagement, optional media download) are all supported by the instructions and selector references.
Instruction Scope
Instructions stay within the stated purpose: they direct the agent to open the tweet URL with the platform browser tool, capture ARIA snapshots, extract fields, and optionally download media. One caution: the SKILL.md suggests using shell commands (curl/wget via exec) to download media URLs — that will cause the agent to fetch and write arbitrary remote URLs to disk if the user requests downloads. This is expected for media-download functionality but is a side-effect users should be aware of (disk writes, potentially untrusted URLs, and copyright considerations). Also, SKILL.md and references include both x.com and twitter.com, whereas the shipped scripts/extract.mjs enforces a simple check for 'x.com' only — a minor inconsistency in domain handling.
Install Mechanism
No install spec is included (instruction-only plus a small helper script). Nothing is downloaded from external URLs during installation and no archives are extracted. This is the lowest-risk install profile.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The code and SKILL.md do not access environment secrets. This is proportionate to a public-web scraping/browser-automation tool.
Persistence & Privilege
always is false (default). The skill does not request permanent/system-wide configuration changes and contains no steps to alter other skills. Autonomous invocation is allowed (platform default) and acceptable given the skill's purpose.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install x-extract - After installation, invoke the skill by name or use
/x-extract - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of x-extract skill.
- Extracts tweet content (text, media, author, metadata) from x.com/twitter.com URLs without requiring Twitter API credentials.
- Uses browser automation to fully load tweets and extract data from the rendered HTML.
- Outputs results in structured markdown, including optional media download.
- Handles single tweets, threads, and error situations (invalid URLs, restricted tweets, layout changes).
- Does not support protected tweets or content requiring login.
Metadata
Frequently Asked Questions
What is X Extract?
Extract tweet content from x.com URLs without credentials using browser automation. Use when user asks to "extract tweet", "download x.com link", "get tweet... It is an AI Agent Skill for Claude Code / OpenClaw, with 796 downloads so far.
How do I install X Extract?
Run "/install x-extract" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is X Extract free?
Yes, X Extract is completely free (open-source). You can download, install and use it at no cost.
Which platforms does X Extract support?
X Extract is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created X Extract?
It is built and maintained by Chunhua Liao (@chunhualiao); the current version is v1.0.0.
More Skills