twitter-ai-kol-fetcher

抓取 Twitter AI 领域 KOL 最新动态、识别热门话题、生成专业内参。触发条件："抓取 Twitter"、"AI 领域最新动态"、"每天 AI 动态"、"写内参"、"AI 内参"。

This skill aims to fetch Twitter KOL tweets and produce LLM-written intelligence reports — that purpose is coherent with calling a Twitter API and an LLM API. However: 1) The registry claims no credentials but the code needs both a Twitter API key and an OpenRouter key; treat that as a red flag until corrected. 2) scripts/01_fetch_kols.py contains a hardcoded Twitter API key — remove or rotate it and do not run code that embeds unknown credentials. 3) SKILL.md promises not to save local files and to send reports to Feishu, but the code saves JSON in /tmp and contains no Feishu-send logic; do not assume private data won’t be stored or transmitted. 4) The repository contains multiple clear coding errors (invalid import syntax referencing filenames starting with digits in scripts/main.py, undefined KOL_LIST in 01_fetch_kols.py), so the code will likely fail or behave unpredictably. Before installing or running: - Do not run on a production machine. Use an isolated environment/VM. - Inspect and remove any hardcoded credentials; supply your own keys only via environment variables or a secure config. - Fix the import/identifier bugs and add explicit, auditable Feishu/webhook code if you want automated delivery. - Decide and document what data is sent to the LLM provider (OpenRouter) — tweets and metadata will be transmitted and may be logged by that service. - Consider rotating any keys that might have been exposed if you accidentally used the embedded default key. If you cannot or will not audit and fix these issues, do not install/run this skill.

Type: OpenClaw Skill Name: twitter-ai-kol-fetcher Version: 1.0.1 The skill bundle contains a hardcoded API key for the twitterapi.io service within `scripts/01_fetch_kols.py`, which is a significant security risk. Additionally, the report generation logic in `scripts/03_generate_report.py` is vulnerable to indirect prompt injection because it incorporates unsanitized tweet content directly into LLM prompts. The code also exhibits several functional bugs (e.g., a NameError in the fetcher script) and discrepancies between the stated features in `SKILL.md` (such as Feishu integration) and the actual implementation, suggesting the bundle is poorly vetted or potentially used as a lure.