Tweet Share Card

Convert an X/Twitter post URL into a polished share card image by capturing the tweet content and compositing it on a styled background.

This skill will open a browser tab in a visible Chrome window and take a screenshot of the browser area using macOS-specific tools (osascript and /usr/sbin/screencapture). That means: (1) it only realistically works on macOS with Google Chrome available; (2) it can capture on-screen content — potentially sensitive information if the browser or window shows other data; (3) the skill metadata does not declare these OS/binary requirements, which is an inconsistency you should ask the author to fix. Before installing: verify you want a skill that can control your browser and capture screenshots, confirm you are on macOS and have a dedicated Chrome profile for this use, inspect the two included scripts, and ensure the agent is only allowed to run the skill when you explicitly invoke it (disable autonomous invocation if you prefer). If you are not on macOS or do not want desktop/browser screenshots to be taken, do not install.

Type: OpenClaw Skill Name: tweet-share-card Version: 0.1.0 The skill is classified as suspicious due to a critical command injection vulnerability in `scripts/capture_visible_tweet.py`, where the `url` argument is unsafely interpolated into an AppleScript string executed via `osascript`. This flaw allows for potential Remote Code Execution (RCE) on the host system if a malicious URL is provided to the agent. While the use of browser automation and the `/usr/sbin/screencapture` utility aligns with the stated purpose of generating tweet share cards, the combination of high-privilege system access and a lack of input sanitization poses a significant security risk.