X Knowledge Base

自動收集 X 書籤並轉化為 Obsidian 知識庫，配備 AI 濃縮與交叉連結功能，支援自我進化趨勢分析

Key things to consider before installing: - Metadata mismatch: The registry says no required env vars/binaries, but the SKILL.md and scripts require BIRD_AUTH_TOKEN and BIRD_CT0 and expect bird CLI, curl, and Python. Confirm these requirements and failure modes before installing. - Privacy / data exfiltration: The skill sends bookmark/article URLs and full text to external services (r.jina.ai for fetching page content and the MiniMax endpoint for summarization). If your bookmarks contain private or sensitive content, that content will be transmitted to third parties. Only provide API keys/tokens if you trust those services and accept that data flow. - Token scope and handling: BIRD tokens grant access to your X/Twitter account bookmarks—treat them like passwords. Provide the minimal-privilege tokens and avoid running the skill on a shared account or host you don't control. - Default paths and filesystem access: Scripts use hardcoded defaults under /home/ubuntu/clawd/..., which may read/write many files in that tree. Consider running in an isolated environment (container or dedicated user) and override SOURCE_DIR/BOOKMARKS_DIR/OBSIDIAN_DIR to safe locations. - Optional API keys: You can skip AI summarization by leaving MINIMAX_API_KEY unset (scripts check for this), reducing external calls. - Inspect and test locally: Because code is bundled, review or run the scripts in a safe environment first. Pay attention to the Jina URL variants in docs vs scripts (they differ slightly) and test with non-sensitive bookmarks. If you want to proceed, run the skill in an isolated VM/container, set explicit target directories, and avoid providing API keys until you verify behavior with dummy data.

Type: OpenClaw Skill Name: x-knowledge-base Version: 1.0.2 The skill is classified as suspicious due to several security vulnerabilities and risks, rather than clear malicious intent. Sensitive environment variables (`BIRD_AUTH_TOKEN`, `BIRD_CT0`) are passed directly as command-line arguments in `scripts/fetch_bookmarks.sh`, making them potentially visible in process lists. The skill also heavily relies on external third-party services (Jina AI, MiniMax API, Brave Search API) and an external CLI tool (`bird CLI`), introducing significant supply chain risks. While the skill's stated purpose is benign, these practices represent security flaws that could be exploited.