social-reader

Social media content scraping and automation skill. Supports real-time single post reading, as well as scheduled batch patrol, LLM distillation, and review n...

This package appears to do what it says: fetch public social posts, optionally call an LLM to synthesize commentary, and present a local review UI. Before installing or running it: - Treat pipeline mode as networked: it requires an LLM API key and will send scraped content to the configured LLM endpoint (default: OpenAI). Only use a trusted API key and be aware of any sensitive content you feed to the LLM. - The notifier starts a local HTTP server and opens a browser. Verify the server binds only to localhost (127.0.0.1) if you do not want it reachable from the network. If the server binds to all interfaces, external actors could call /api/regenerate or /api/review if your machine/network is reachable. - The skill writes local files (seen_ids.json, pending_tweets.json, drafts.json, archive.json) in the skill directory; run it in an environment/directory where this persistence is acceptable. - Source and homepage are unknown — exercise caution. If you need higher assurance, ask the maintainer for the origin, check how notifier starts the HTTPServer (inspect whether it binds to 'localhost' vs ''), and consider running in an isolated container or VM and restricting outbound network access for the process. - If you want lower risk for interactive usage, follow the SKILL.md guidance to call fetcher.get_tweet() only (stateless) rather than running the full pipeline.

Type: OpenClaw Skill Name: social-reader Version: 1.0.0 The skill is classified as suspicious due to several risky capabilities, even though they are presented as part of its intended functionality. Specifically, `notifier.py` starts a local HTTP server on `127.0.0.1:18923` and automatically opens a browser window to this local URL, which are significant actions. Additionally, `notifier.py` uses `subprocess.Popen` to execute a PowerShell command for desktop notifications, a shell execution primitive, though the command itself is fixed and benign in this context. Furthermore, `processor.py` feeds untrusted external content (tweet text) into an LLM prompt, introducing a prompt injection vulnerability against the LLM, even if the LLM's output is subject to human review.