X Founder Operations

Systematic X (Twitter) operations skill for founders, indie developers, and tech professionals. Implements a daily Plan-Do-Check-Act closed loop with content...

Before installing or running this skill, do the following: 1) Inspect the Python scripts (scripts/*.py) yourself or have a developer review them for network calls (requests/httpx/urllib), subprocess exec, and any hardcoded endpoints. Look for code that reads files outside the skill folder or attempts to POST data to non-X domains. 2) Search the code for where X API keys or tokens would be read. If the scripts expect tokens, confirm whether they read them from a config file, environment variables, or prompt the user. The skill currently declares no required credentials — ask the author to document authentication flow. 3) If you need to provide credentials, use a least-privileged X API token and avoid pasting full-account credentials into unclear files. Consider using short-lived tokens and revoke them after testing. 4) Run the scripts in an isolated environment (container or VM) with network monitoring turned on. Test with a throwaway X account first to observe behavior (does it post, DM, or only read?). 5) Confirm all external endpoints are legitimate (api.x.com or other documented X endpoints). Reject or inspect any traffic to unfamiliar domains or personal servers. 6) Prefer a version of the skill where the author documents required dependencies, exact credential names, and a minimal set of scopes needed. If the author cannot provide clear provenance and a README mapping actions → required tokens, treat the skill as risky. What would change this assessment: if the author publishes the script source with clear comments showing only local, read-only analysis (no network calls) or documents an explicit, minimal OAuth flow with which the scripts run only when you intentionally supply a token and the skill does not transmit data to third-party endpoints, then the mismatch concerns would be resolved and the skill could be reevaluated as coherent.

Type: OpenClaw Skill Name: x-founder-operations Version: 0.1.0 The OpenClaw AgentSkills skill bundle is benign. All Python scripts (`analytics_reporter.py`, `content_planner.py`, `x_data_validator.py`) perform data processing and analysis without any file system writes, network calls, or system command execution. The `SKILL.md` and other markdown documentation (e.g., `references/cron-schedule.md`) contain explicit instructions for the AI agent to prioritize data integrity, avoid fabrication, and stop on API failures, which actively mitigates prompt injection risks rather than exploiting them. There is no evidence of data exfiltration, persistence mechanisms, or any other malicious intent.