X Extract

Extract tweet content from x.com URLs without credentials using browser automation. Use when user asks to "extract tweet", "download x.com link", "get tweet...

This skill is internally consistent for scraping public x.com/twitter.com tweet pages via the platform browser tool and does not request credentials. Before installing, consider: 1) Media download option uses shell tools (curl/wget) to fetch and write remote URLs — only download media you trust and be mindful of disk storage and copyright. 2) Excessive automated requests may trigger X.com rate-limiting or IP blocking. 3) The included helper script is primarily an instructions writer (it prints snapshot instructions) and has a minor mismatch: SKILL.md supports both x.com and twitter.com but the script currently checks only for 'x.com'. If you require twitter.com domain support, review/adjust the code. 4) Ensure your OpenClaw agent’s browser tool access is intentional, since the skill relies on that tool to load pages. If you need higher assurance, review the script and selectors file line-by-line before enabling downloads or granting the agent broad autonomous access.

Type: OpenClaw Skill Name: x-extract Version: 1.0.0 The skill is suspicious due to a potential shell injection vulnerability in `SKILL.md`. The instructions for the AI agent explicitly use `exec` with `curl` to download media, constructing a shell command with `<media-url>` directly from an external source (x.com). If a malicious actor could control the content of `<media-url>` (e.g., by posting a tweet with a specially crafted URL containing shell metacharacters), this could lead to arbitrary command execution on the agent's host. This is a high-risk vulnerability, even if the stated purpose of downloading media is benign.