X Manager

Manage X (Twitter) accounts — post tweets, like, reply, retweet, view timeline, search, auto-interact, analyze data.

This skill appears to do what it says, but check these things before installing: 1) It expects per-user credential files in credentials/{USER_ID}.json — ensure you are comfortable storing API keys in that location and protect that directory. 2) The SKILL metadata lists TWITTER_* env vars but the scripts ignore them — decide whether you prefer env-based or file-based credentials and adjust accordingly. 3) The scripts use the 'requests' library and optionally a 'twitterv2' client but no install steps are provided; ensure your environment has those packages. 4) Verify the Twitter API tier and tokens you provide are appropriate (some endpoints require elevated privileges). 5) Note a stray string referencing storyclaw.com in an error message — benign by itself, but if you need external hosting or redirects, confirm the origin. If you want higher assurance, ask the author for a documented install/requirements file and clarify whether env vars or credential files are the intended auth mechanism.

Type: OpenClaw Skill Name: x-manager Version: 0.1.0 The skill provides legitimate Twitter management functionality but contains a path traversal vulnerability across all script files (e.g., scripts/post_tweet.py, scripts/get_timeline.py, scripts/search_tweets.py). The `user_id` command-line argument is used directly to construct file paths for loading credentials (e.g., `credentials/{user_id}.json`) without sanitization, which could allow an attacker to access or verify the existence of arbitrary JSON files on the system. While the code aligns with its stated purpose, this vulnerability represents a significant security flaw.