← 返回 Skills 市场
Falcon
作者
BubblyJove
· GitHub ↗
· v1.0.0
970
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install falcon
功能描述
Search, read, and interact with Twitter/X via TwexAPI
使用说明 (SKILL.md)
falcon
Use falcon to read, search, and interact with Twitter/X.
Quick start
falcon check
falcon user elonmusk
falcon tweets elonmusk 5
falcon read \x3Curl-or-id>
falcon search "bitcoin" 10
Reading users
falcon user \x3Cusername> Profile info for a single user
falcon users \x3Cu1,u2,...> Look up multiple users (comma-separated)
falcon find \x3Ckeyword> [count] Search for users by keyword (default: 5)
falcon followers \x3Cusername> [count] List followers (default: 20)
falcon following \x3Cusername> [count] List following (default: 20)
Reading tweets
falcon tweets \x3Cusername> [count] User's tweets and replies (default: 20)
falcon read \x3Cid-or-url> [...] Read one or more tweets by ID or URL
falcon replies \x3Cid-or-url> [count] Replies to a tweet (default: 20)
falcon similar \x3Cid-or-url> Find similar tweets
falcon retweeters \x3Cid-or-url> [cnt] Who retweeted a tweet (default: 20)
Searching
falcon search \x3Cquery> [count] Advanced search (default: 10)
falcon hashtag \x3Ctag> [count] Search by hashtag (default: 20)
falcon cashtag \x3Ctag> [count] Search by cashtag (default: 20)
falcon trending [country] Trending topics (default: worldwide)
Posting (confirm with user first)
falcon tweet "text"
falcon reply \x3Cid-or-url> "text"
falcon quote \x3Ctweet-url> "text"
Engagement (confirm with user first)
falcon like \x3Cid-or-url>
falcon unlike \x3Cid-or-url>
falcon retweet \x3Cid-or-url>
falcon bookmark \x3Cid-or-url>
falcon follow \x3Cusername>
falcon unfollow \x3Cusername>
Account
falcon check Verify API key and cookie are set
falcon balance Check remaining API credits
Auth sources
TWEXAPI_KEY env var: TwexAPI bearer token (required for all commands)
TWITTER_COOKIE env var: Twitter auth cookie (required for write/engagement commands)
Important notes
- The falcon script lives at {baseDir}/falcon.sh
- All commands accept tweet URLs (x.com or twitter.com) or bare tweet IDs
- Always confirm with the user before executing any write or engagement command
- Search accepts any Twitter advanced search syntax
- Hashtags can be passed with or without the # prefix
- Cashtags can be passed with or without the $ prefix
- Country for trending uses slug format: united-states, united-kingdom, japan, etc.
安全使用建议
Things to check before installing or using this skill:
- Understand what will be transmitted: the falcon script sends TWITTER_COOKIE (your Twitter auth cookie) to the third-party endpoint at api.twexapi.io for any write/engagement action. Treat this value like a password — supplying it to a third party can allow account actions.
- Ask the author to fix the metadata: TWITTER_COOKIE is used by the code but is not declared in requires.env. The skill should explicitly list TWITTER_COOKIE as a required environment variable so you can make an informed decision.
- Consider scope limitation: if you only need read/search, avoid setting TWITTER_COOKIE and limit usage to read-only commands while keeping TWEXAPI_KEY only. Confirm that the skill and the platform will prompt you before any write operation as claimed.
- Verify trust in TwexAPI: review TwexAPI's privacy/security documentation and confirm that api.twexapi.io is the intended and legitimate service. Prefer delegated OAuth tokens or official API methods rather than sharing raw browser cookies.
- If you must provide a cookie, consider using a throwaway/test account rather than your primary account.
- Inspect the included falcon.sh yourself (or run it locally in a safe environment) before providing credentials; it transparently builds JSON bodies and uses temporary files for headers/bodies (which is good practice), so review the full code path for any unexpected endpoints.
- Optional: ask the maintainer to change the design to avoid sending cookies (use TwexAPI-managed OAuth or server-side authentication) and to update SKILL.md and registry metadata to list all env vars and explain why each is needed.
Given the sensitivity of cookies and the metadata mismatch, treat this skill as suspicious until the cookie-handling and metadata are clarified.
功能分析
Type: OpenClaw Skill
Name: falcon
Version: 1.0.0
The skill is designed to interact with TwexAPI for Twitter/X, requiring `TWEXAPI_KEY` and `TWITTER_COOKIE` environment variables. The `falcon.sh` script demonstrates robust security practices, including extensive input validation (regex for usernames, counts, path segments) to prevent shell injection, and secure handling of secrets by writing them to temporary files for `curl` to avoid exposure in process arguments. JSON payloads are constructed using `jq -n --arg` to properly escape user input, mitigating JSON injection risks. The `SKILL.md` explicitly instructs the AI agent to confirm write and engagement actions with the user, which is a positive security measure. Permissions in `.claude/settings.local.json` are appropriate for a CLI tool, and no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence, or obfuscation was found.
能力评估
Purpose & Capability
Name/description align with the implementation: the script calls a TwexAPI base URL to read/search and perform write/engagement actions on Twitter/X. Required binaries (curl, jq) are appropriate for the CLI implementation.
Instruction Scope
SKILL.md and falcon.sh instruct the agent to perform read and write operations through TwexAPI and explicitly require a TWITTER_COOKIE for write/engagement commands. The instructions also say to 'confirm with the user' before writes (good), but they allow sending the user's Twitter cookie to the external TwexAPI service — this transmits a sensitive credential outside the local machine. Additionally, TWITTER_COOKIE is referenced in runtime instructions but is not declared in the skill's metadata requires.env (inconsistency).
Install Mechanism
No install spec is provided (instruction-only style). A script file is included but nothing is downloaded or extracted during install, so there is no high-risk remote install mechanism.
Credentials
Metadata declares only TWEXAPI_KEY as required, but the script requires TWITTER_COOKIE for any write actions and will include that cookie in POST bodies to api.twexapi.io. Requesting a full account cookie is high‑sensitivity: it can grant account access and is being sent to a third-party. The metadata mismatch (not declaring TWITTER_COOKIE) makes the requested access opaque to users.
Persistence & Privilege
The skill does not request always: true and does not modify other skills or system settings. disable-model-invocation is false (normal). No excessive persistence or privileged platform presence is requested.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install falcon - 安装完成后，直接呼叫该 Skill 的名称或使用
/falcon触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of falcon, a skill to interact with Twitter/X via TwexAPI.
- Search, read, and interact with Twitter/X accounts and tweets using simple commands.
- Supports reading user profiles, tweets, replies, followers, and trending topics.
- Enables posting tweets, replies, liking, retweeting, bookmarking, following, and unfollowing (with user confirmation).
- Uses environment variables for API key and cookie authentication.
- Requires curl and jq binaries; compatible with macOS and Linux.
元数据
常见问题
Falcon 是什么？
Search, read, and interact with Twitter/X via TwexAPI. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 970 次。
如何安装 Falcon？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install falcon」即可一键安装，无需额外配置。
Falcon 是免费的吗？
是的，Falcon 完全免费（开源免费），可自由下载、安装和使用。
Falcon 支持哪些平台？
Falcon 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（darwin, linux）。
谁开发了 Falcon？
由 BubblyJove（@bubblyjove）开发并维护，当前版本 v1.0.0。
推荐 Skills