X Mobile Longshot / X 真机感长截图导出

Render X (Twitter) posts, long articles, and mobile reading pages into mobile-style long screenshots and optional single-page PDFs using Playwright. Use when...

This skill appears to do what it says (capture mobile-style screenshots of X pages), but the package metadata omits key runtime requirements. Before installing or running it: 1) Ensure the runtime has Node.js and the Playwright Node package (and its browsers) installed, and has python3 with Pillow available — the script calls python3 via spawnSync to process images. 2) Run it in an isolated environment (no sensitive credentials mounted) because it will fetch arbitrary URLs you supply and write files to disk. 3) Review the bundled script if you need stricter safety: it performs DOM clicks/removals (to dismiss overlays) and executes local Python code — both expected for this task but worth auditing. 4) Prefer adding explicit dependency/install steps (Playwright browser install, pip install Pillow) to the skill manifest or run within a container where you control installed packages. If you need higher assurance, ask the author to declare required binaries and provide an install spec rather than relying on implicit environment setup.

Type: OpenClaw Skill Name: x-mobile-longshot Version: 1.0.1 The skill is classified as suspicious due to a code injection vulnerability in `scripts/render_x_longshot.js`. The script constructs a Python snippet using unsanitized input from the `--out-png` argument and executes it via `spawnSync`, which could allow arbitrary Python code execution if the output path is manipulated. While the tool's functionality for capturing and cleaning X (Twitter) screenshots appears legitimate and aligned with its stated purpose, this implementation flaw poses a significant security risk.