Storyclaw X Manager

Manage X (Twitter) accounts — post tweets, like, reply, retweet, view timeline, search, auto-interact, analyze data.

What to consider before installing: - The code implements the advertised X/Twitter actions and talks only to api.twitter.com, but the skill is sloppy about how it expects credentials. It declares required TWITTER_* env vars in metadata but the Python scripts ignore environment variables and instead load plaintext credentials from credentials/{USER_ID}.json. That means you must store Twitter tokens locally in that credentials/ folder for each user — which is sensitive and could be read by others with file access. - There is no install script or dependency list. The scripts import 'requests' (and optionally 'twitterv2') but the skill won't install these for you; running will fail unless those Python packages are present. - SKILL.md mentions auto-interaction and state/{USER_ID}.json configuration, but none of the provided scripts implement that. The presence of a 'bind at storyclaw.com' message in a script is suspicious/unclear (code does not contact that domain) — ask the author to clarify whether an external service is required or used. - If you decide to use this skill: only supply tokens you can revoke, use minimal-permission tokens where possible, store credentials with restrictive file permissions, run the skill in an isolated environment (container or VM), review and/or remove references to external services, and consider modifying the code to read environment variables if you prefer not to keep plaintext credential files. If you need absolute assurance, request an updated version that: (1) consistently uses either env vars or credential files (not both), (2) documents and installs required Python packages, and (3) removes or explains any references to external domains such as storyclaw.com.

Type: OpenClaw Skill Name: storyclaw-x-manager Version: 0.1.0 The skill provides standard Twitter/X management capabilities including posting, liking, retweeting, and searching via the official Twitter API v2. The implementation uses the Python requests library to interact with legitimate Twitter endpoints (api.twitter.com) and stores user-provided credentials in a local directory as described in the documentation. No evidence of data exfiltration, malicious execution, or prompt injection was found.