X Deep Miner

X (Twitter) 深度挖掘与归档 Skill。每小时自动扫描 AI/美股/生活类高热度推文（收藏>1000），自动翻译为专业中文文章，输出 Obsidian 格式。适用于构建个人知识库、每日情报简报。

This skill is mostly a scaffold that matches its description but is not fully automated: it prints instructions for using a managed browser and lists LLM/X API integration as TODOs. Before installing/running: 1) Inspect scripts/x_deep_miner.py yourself (you already have it); running it will create files under WORKSPACE_DIR (default /Users/scott/.openclaw/workspace) — set WORKSPACE_DIR to a safe directory you control. 2) Use the 'test' command first to see behavior without saving. 3) If you enable browser automation, prefer an isolated browser/profile (avoid using your logged-in browser profile because automation can capture session data/cookies). 4) Be cautious if you later supply X API keys or LLM API credentials — review any added code that uses them. 5) If you need fully automated scraping at scale, expect to provide credentials or extend/complete the browser automation code; the current package alone will not perform automatic network scraping. If any of this is surprising (automatic scraping, file writes), do not run it until you adjust paths and confirm desired behavior.

Type: OpenClaw Skill Name: x-deep-miner Version: 1.2.0 The skill 'x-deep-miner' is designed to scrape X (Twitter) content and save it locally. While its stated purpose is benign, the `scripts/x_deep_miner.py` file uses `print` statements to suggest browser automation commands (e.g., `browser action=start profile=openclaw`, `browser action=open targetUrl=https://x.com/home`) for the OpenClaw agent to execute. This method of agent interaction, where the agent interprets arbitrary stdout as commands, represents a significant prompt injection vulnerability and a high-risk capability, even though the current commands are for a legitimate purpose. There is no evidence of intentional malicious behavior like data exfiltration or unauthorized system access, but the underlying mechanism is risky.