功能描述

Manage X (Twitter) account: auto-post AI-generated tweets, monitor brand mentions, auto-like relevant posts, and send Telegram approval requests for replies.

使用说明 (SKILL.md)

BytesAgain X Manager

Name: Bytesagain X Manager
Author: loutai0307-prog

Manage your X (Twitter) account with automated posting, monitoring, and engagement. Generates tweet drafts via xAI, validates content before posting, and routes mention replies through human approval.

Setup

This skill requires the following environment variables to be configured before use:

Variable	Required	Description
`X_API_KEY`	✅	X API Key from developer.x.com (Read+Write app)
`X_API_SECRET`	✅	X API Key Secret
`X_ACCESS_TOKEN`	✅	X Access Token (account-specific)
`X_ACCESS_TOKEN_SECRET`	✅	X Access Token Secret
`X_USER_ID`	✅	Your X account numeric user ID
`XAI_API_KEY`	✅	xAI API key for Grok tweet generation
`TG_TOKEN`	✅	Telegram bot token for approval notifications
`TG_CHAT`	✅	Telegram chat ID to receive notifications

No credentials are stored or transmitted by this skill. All values are read from environment variables at runtime only.

What This Skill Owns

Tweet posting and replies: publish content via X API OAuth 1.0a with pre-post validation
Daily content generation: create 3 tweet drafts/day using xAI trend analysis
Brand monitoring: scan @bytesagain mentions every 2 hours, draft replies for approval
Auto-like: like AI/skill related tweets to grow visibility
Competitor tracking: monitor @openclaw and related accounts
Telegram approval workflow: route all mention replies through human confirmation

What This Skill Does Not Cover

Sending DMs (requires additional OAuth scope not currently enabled)
Deleting tweets (requires explicit human authorization per tweet)
Deep analytics (follower growth trends, engagement rate analysis)
Posting images or videos (text-only)
Accessing private or protected accounts
Publishing skills to ClawHub (use skill-manager for that)

Commands

draft

Generate 3 tweet drafts for the day using xAI trend analysis. Saves to /tmp/x-drafts-YYYY-MM-DD.json.

bash scripts/script.sh draft

post

Post a tweet from today's saved drafts. Use --index to select which draft (0=first, 1=second, 2=third).

bash scripts/script.sh post --index 0
bash scripts/script.sh post --index 1
bash scripts/script.sh post --index 2

monitor

Run brand and competitor monitoring report. Tracks @bytesagain mentions, @openclaw activity, and AI skill trends. Sends Telegram report with Chinese summary.

bash scripts/script.sh monitor

like

Auto-like recent tweets matching AI agent / skill keywords. Skips own tweets and already-liked posts.

bash scripts/script.sh like

scan-mentions

Scan recent @bytesagain mentions, draft replies via xAI, and send Telegram approval requests to operator.

bash scripts/script.sh scan-mentions

send-reply

Send a pre-approved reply to one or more tweets. Multiple IDs are staggered 30–90 seconds apart to appear natural.

bash scripts/script.sh send-reply \x3Ctweet_id>
bash scripts/script.sh send-reply \x3Ctweet_id1> \x3Ctweet_id2> \x3Ctweet_id3>

status

Show pending approval queue and today's saved drafts.

bash scripts/script.sh status

Approval Workflow

scan-mentions detects new @bytesagain mentions
xAI drafts a reply for each mention
Telegram message sent to operator: original tweet + draft reply + tweet ID
Operator replies 发 \x3Ctweet_id> to approve, 跳过 \x3Ctweet_id> to skip
Agent calls send-reply \x3Ctweet_id> to post the approved reply

Validation Rules (pre-post checks)

All tweets are validated before posting:

Check	Result
Link in tweet body	❌ Blocked (X penalizes -40%)
More than 2 hashtags	❌ Blocked
Specific large numbers (e.g. 10000, 500K)	❌ Blocked (may be inaccurate)
Banned words (guaranteed, make money…)	❌ Blocked
No question mark	⚠️ Warning only
Tweet under 50 characters	⚠️ Warning only

Blocked tweets trigger a Telegram notification with the reason. Fallback preset templates are used if xAI times out.

Recommended Cron Schedule

30 8  * * *     monitor          # Daily brand report
0  9  * * *     draft            # Generate daily drafts (1 xAI call/day)
0  9,13,17,21 * * *  like        # Auto-like 4x daily
5  10 * * *     post --index 0   # Post tweet #1
5  15 * * *     post --index 1   # Post tweet #2
5  20 * * *     post --index 2   # Post tweet #3
0  */2 * * *    scan-mentions    # Check mentions every 2 hours

State Files

File	Purpose
`/tmp/x-drafts-YYYY-MM-DD.json`	Daily tweet drafts
`/tmp/x-liked-ids.json`	Dedup: already-liked IDs (last 500)
`/tmp/x-seen-mentions.json`	Dedup: processed mention IDs (last 200)
`/tmp/x-pending-replies.json`	Pending approval queue

Requirements

Python 3.8+
requests — HTTP client
requests-oauthlib — OAuth 1.0a for X API

pip install requests requests-oauthlib

References

Command Boundary — full in/out-of-scope rules and safety constraints
API Notes — X API v2 rate limits, auth, and cost estimates

Evals

Trigger boundary test cases: evals/trigger_cases.json — 12 cases (6 positive + 6 negative)

Feedback

https://bytesagain.com/feedback/ Powered by BytesAgain | bytesagain.com

安全使用建议

Before installing or running this skill: - Review and correct the SKILL.md mismatch: the code stores pending replies at ~/.local/share/x-manager/pending-replies.json, not /tmp/x-pending-replies.json. Expect persistent files under your home directory. - Understand credential use: the X API keys, X access tokens, xAI API key, and Telegram bot token are required and will be used to call external services (Twitter/X, api.x.ai, and api.telegram.org). They are not persisted by the code as plaintext aside from runtime use, but the Telegram messages include draft content and tweet IDs—treat these as data leaving your environment. - Consider using dedicated, least-privilege credentials (an X account only for automation) and a Telegram bot/chat created for this purpose. Limit permissions and rotate keys if needed. - Audit the code yourself or run in a sandboxed account first: verify network endpoints (api.twitter.com, api.x.ai, api.telegram.org) and inspect what is being sent in Telegram notifications and xAI requests. - If you prefer ephemeral state, modify the code to store all state in /tmp or a configurable directory, and ensure file permissions restrict access (avoid world-readable JSON files containing drafts/IDs). - Be aware of platform policy risks: automated likes and automated posting can run afoul of X rules; configure rate/timing and keep human approval for replies as intended. If you want, I can highlight the exact lines where the pending file path is set, show every external endpoint the scripts call, or suggest minimal code edits to make state storage configurable and documented.

功能分析

Type: OpenClaw Skill Name: bytesagain-x-manager Version: 1.6.0 The BytesAgain X Manager skill is a legitimate social media automation tool designed to manage X (Twitter) accounts via the X API, xAI (Grok), and Telegram. It implements a 'human-in-the-loop' workflow where AI-generated replies to mentions are sent to a Telegram bot for operator approval before being posted. The code (x-engage.py and x-monitor.py) follows its stated purpose, includes tweet validation logic to avoid platform penalties, and handles credentials securely via environment variables without evidence of exfiltration, obfuscation, or unauthorized execution.

能力标签

cryptocan-make-purchasesrequires-oauth-tokenrequires-sensitive-credentialsposts-externally

能力评估

✓ Purpose & Capability

Name/description (auto-post, monitor mentions, auto-like, Telegram approvals) align with the actual code: scripts call X API endpoints, xAI endpoints, and Telegram for approvals. Required credentials listed in SKILL.md (X API keys, XAI key, TG token/chat, X user id) are appropriate for the declared functions.

⚠ Instruction Scope

Runtime instructions and the Python scripts perform exactly the declared tasks, but SKILL.md claims state files live in /tmp (e.g. /tmp/x-pending-replies.json) while x-engage.py actually writes the pending-queue to ~/.local/share/x-manager/pending-replies.json. SKILL.md also states "No credentials are stored or transmitted by this skill," which is misleading: credentials are read from environment and are used to authenticate to external services (Twitter/x, xAI, Telegram). The agent will send message content and drafts to Telegram and xAI endpoints as part of normal operation.

✓ Install Mechanism

There is no install spec (instruction-only installer), no external download, and the included code files are present in the skill bundle. This is the lower-risk install pattern; however the Python scripts require requests and requests-oauthlib which must exist in the runtime environment.

ℹ Credentials

The set of environment variables required (X API keys and secrets, X user id, XAI API key, Telegram token and chat id) are proportional to a social-media automation tool. No unrelated credentials are requested. Note: the code uses those env vars at runtime (no evidence of additional secret collection), but the documentation's 'no credentials transmitted' statement is ambiguous and should be corrected.

⚠ Persistence & Privilege

The skill writes persistent state: /tmp files (liked IDs, seen mentions, drafts) and a persistent pending-replies file under the user's home (~/.local/share/x-manager/pending-replies.json). Writing into the user's home directory is more persistent than /tmp and could surprise operators expecting ephemeral state. always:false (not force-included) and normal autonomous invocation are set; not flagged alone but combine with persistent files to increase blast radius if misused.

版本历史

v1.6.0

Fix: add Setup table with all required env vars; remove duplicate credentials section

v1.5.0

Fix moderation: add required credentials declaration in YAML frontmatter

v1.4.0

Fix: parameterize X user ID via env var; remove all hardcoded account identifiers

v1.3.0

Security fix: remove local .env file access; all credentials now via environment variables only

v1.2.0

Fix: add unified scripts/script.sh entry point; update all commands to standard bash scripts/script.sh format for moderation compliance

v1.1.0

Add boundary declarations (What This Skill Owns/Does Not Cover), evals/trigger_cases.json (12 test cases), references/command-boundary.md and api-notes.md

v1.0.1

Fix: ensure SKILL.md frontmatter and script structure pass moderation

v1.0.0

Initial release: auto-post 3 tweets/day, brand monitoring, auto-like, mention approval workflow via Telegram

元数据

Slug bytesagain-x-manager

版本 1.6.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 8

常见问题