Twitter Automation Suite

Twitter/X 自动化运营套件。自动发推、监控关键词、批量回复、AI 生成推文内容。适合社交媒体运营、账号增长、竞品监控。

Proceed with caution. The post.js script does perform browser automation and needs your Twitter username/password in a .env — only use these credentials if you absolutely trust the source and prefer browser-driven automation over OAuth/API tokens. The package advertises monitoring/reply/analysis features but the corresponding scripts are missing; this indicates the package is incomplete or poorly maintained. Before installing: (1) prefer OAuth/API tokens (twitter-api) or app-specific credentials instead of your primary password; (2) inspect any missing scripts if the publisher supplies updates — they could change behavior; (3) run in an isolated environment or throwaway account if you want to test; (4) verify the package author and repository (there's no homepage/source) and ask the publisher why metadata doesn't declare required env vars and why some dependencies and scripts are unused. If you are unsure, do not supply primary account credentials.

Type: OpenClaw Skill Name: twitter-automation-suite Version: 1.0.0 The bundle provides Twitter automation via Puppeteer but contains high-risk patterns and potential vulnerabilities. It requires users to store plaintext credentials (including passwords) in a .env file and executes Puppeteer with the --no-sandbox flag in scripts/post.js, which bypasses critical browser security layers. Furthermore, index.js passes unsanitized command-line arguments directly to child_process.spawn, creating a potential argument injection vulnerability. While no explicit data exfiltration or malicious intent was detected, the handling of sensitive credentials and insecure execution patterns warrant caution.